CVE-2021-24132: Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection
Published Mar 18, 2021
·Updated
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.
Affected Software
1 affected component
10web Slider Wordpress<1.2.36
Event History
Mar 18, 2021
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-24132.
2
What is the affected software?
The affected software is the Slider by 10Web WordPress plugin versions before 1.2.36.
3
What is the severity level of this vulnerability?
This vulnerability has a severity level of high.
4
How can an attacker exploit this vulnerability?
An attacker with high or medium privilege levels can exploit this vulnerability to perform an SQL injection attack.
5
Is there a fix available for this vulnerability?
Yes, updating the Slider by 10Web WordPress plugin to version 1.2.36 or newer will fix this vulnerability.