CVE-2021-24458: Popup box < 2.3.4 - Authenticated Blind SQL Injections
The getayspopupboxes() and getpopupcategories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults() DB calls, leading to SQL injection issues in the admin dashboard
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24458?
CVE-2021-24458 is a vulnerability in the Popup box WordPress plugin before version 2.3.4 that allows SQL injection issues in the admin dashboard.
How does the CVE-2021-24458 vulnerability occur?
The vulnerability occurs because the get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin do not validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls.
What is the severity of CVE-2021-24458?
CVE-2021-24458 has a severity rating of 8.8 (high).
What software is affected by CVE-2021-24458?
The Popup box WordPress plugin before version 2.3.4 is affected by CVE-2021-24458.
How can CVE-2021-24458 be fixed?
To fix CVE-2021-24458, it is recommended to update the Popup box WordPress plugin to version 2.3.4 or later.