CVE-2024-13230: Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13230?
CVE-2024-13230 has been classified as a limited SQL injection vulnerability.
How do I fix CVE-2024-13230?
To fix CVE-2024-13230, update the Super Socializer plugin to version 7.15 or higher.
Which versions of the Super Socializer plugin are affected by CVE-2024-13230?
All versions of the Super Socializer plugin up to and including 7.14 are affected by CVE-2024-13230.
What is the cause of the vulnerability CVE-2024-13230?
CVE-2024-13230 is caused by insufficient escaping on user-supplied parameters in the plugin.
What impact does CVE-2024-13230 have on users?
CVE-2024-13230 can allow attackers to perform limited SQL injection, potentially compromising sensitive data.