CVE-2024-13844: Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13844?
CVE-2024-13844 is classified as a critical SQL Injection vulnerability affecting the Post SMTP plugin for WordPress.
How do I fix CVE-2024-13844?
To fix CVE-2024-13844, update the Post SMTP plugin to version 3.1.3 or later.
What versions of Post SMTP are affected by CVE-2024-13844?
CVE-2024-13844 affects all versions of the Post SMTP plugin up to and including version 3.1.2.
Can CVE-2024-13844 lead to remote code execution?
CVE-2024-13844 could potentially allow an attacker to execute malicious SQL queries, leading to data manipulation or unauthorized access.
What causes the vulnerability in CVE-2024-13844?
The vulnerability in CVE-2024-13844 is due to insufficient escaping of user-supplied parameters in SQL queries.