CVE-2021-4450: Post Grid <= 2.1.12 - Contributor+ SQL Injection
The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4450?
CVE-2021-4450 has been rated as a high severity vulnerability due to the potential for exploitation through SQL injection.
How do I fix CVE-2021-4450?
To fix CVE-2021-4450, update the Post Grid plugin for WordPress to version 2.1.13 or later.
What versions are affected by CVE-2021-4450?
CVE-2021-4450 affects all versions of the Post Grid plugin up to and including 2.1.12.
Can CVE-2021-4450 affect my website?
Yes, if you are using an affected version of the Post Grid plugin, your website is at risk of SQL injection attacks.
What kind of vulnerability is CVE-2021-4450?
CVE-2021-4450 is classified as a blind SQL Injection vulnerability that can lead to unauthorized access to the database.