Medium severity · published Apr 25, 2024
CVE-2024-3265
WP Advanced Search <= 1.1.6 - Admin+ SQL Injection
4.7
CVSS
0.4%
EPSS
No
On KEV
Description
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Advanced Search ·
through 1.1.6 · source: vendor, CISA
AS
Advance Search · Advance Search Project
through 1.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3265
Exploit
https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/
More from Advanced Search
8.7
CVE-2024-2739
Advance Search <= 1.1.6 - Shortcode Deletion via CSRF