CVE-2024-13726: Themes Coder <= 1.3.4 - Unauthenticated SQLi
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13726?
CVE-2024-13726 is rated as a high severity vulnerability due to the potential for SQL injection by unauthenticated users.
How do I fix CVE-2024-13726?
To fix CVE-2024-13726, update the Coder WordPress plugin to version 1.3.5 or later where the SQL injection vulnerability is patched.
Who is affected by CVE-2024-13726?
Users of the Coder WordPress plugin version 1.3.4 and earlier are affected by CVE-2024-13726.
What type of vulnerability is CVE-2024-13726?
CVE-2024-13726 is a SQL injection vulnerability that arises from improper sanitization of parameters.
Can CVE-2024-13726 be exploited remotely?
Yes, CVE-2024-13726 can be exploited remotely, as it is accessible via an AJAX action available to unauthenticated users.