CVE-2023-5439: Wp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for the Wp photo text slider 50 plugin?
The vulnerability ID for the Wp photo text slider 50 plugin is CVE-2023-5439.
What is the severity of CVE-2023-5439?
The severity of CVE-2023-5439 is high with a severity value of 8.8.
How does the SQL Injection vulnerability in the Wp photo text slider 50 plugin occur?
The SQL Injection vulnerability in the Wp photo text slider 50 plugin occurs due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
Which versions of the Wp photo text slider 50 plugin are affected by CVE-2023-5439?
Versions up to, and including, 8.0 of the Wp photo text slider 50 plugin are affected by CVE-2023-5439.
How can I fix the SQL Injection vulnerability in the Wp photo text slider 50 plugin?
To fix the SQL Injection vulnerability in the Wp photo text slider 50 plugin, it is recommended to update to version 8.1 or later.