CVE-2021-36916: WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability
The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will be directly inserted into the SQL query, making SQL injection possible.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36916?
CVE-2021-36916 has been assigned a moderate severity rating due to the potential for SQL injection leading to unauthorized data access.
How do I fix CVE-2021-36916?
To fix CVE-2021-36916, update the Hide My WP WordPress plugin to version 6.2.4 or later.
What versions of Hide My WP are affected by CVE-2021-36916?
CVE-2021-36916 affects Hide My WP plugin versions 6.2.3 and earlier.
What is the risk of not addressing CVE-2021-36916?
Not addressing CVE-2021-36916 could allow attackers to execute arbitrary SQL queries, potentially compromising sensitive information.
How can I prevent SQL injection vulnerabilities like CVE-2021-36916?
To prevent SQL injection vulnerabilities like CVE-2021-36916, always sanitize and validate user inputs before using them in SQL queries.