CVE-2020-13640: SQL Injection

Q: What is CVE-2020-13640?

CVE-2020-13640 is a SQL injection vulnerability in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress.

Q: How does CVE-2020-13640 affect WordPress websites?

CVE-2020-13640 allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request in the wpDiscuz plugin.

Q: Which versions of the gVectors wpDiscuz plugin are affected by CVE-2020-13640?

gVectors wpDiscuz plugin versions up to and including 5.3.5 are affected by CVE-2020-13640.

Q: What is the severity rating of CVE-2020-13640?

CVE-2020-13640 has a severity rating of critical, with a CVSS score of 9.8.

Q: How can I fix CVE-2020-13640?

To fix CVE-2020-13640, users should update the wpDiscuz plugin to version 5.3.6 or later.

Published Jun 18, 2020

Updated

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Affected Software

1 affected component

gVectors Wpdiscuz Wordpress<=5.3.5

Remediation

Patch Available

https://wpdiscuz.com/community/news/security-vulnerability-issue-in-5-3-5-please-udate/

Event History

Jun 18, 2020

CVE Published

via MITRE·02:34 PM

Data Sourced

via MITRE·02:34 PM

Description

Frequently Asked Questions

What is CVE-2020-13640?

CVE-2020-13640 is a SQL injection vulnerability in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress.

How does CVE-2020-13640 affect WordPress websites?

CVE-2020-13640 allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request in the wpDiscuz plugin.

Which versions of the gVectors wpDiscuz plugin are affected by CVE-2020-13640?