CVE-2017-12947

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2017-08-18

Last modified

2024-09-16

Weaknesses

CWE-89

Affected products

• Easy Modal (Easymodal Project)

References

• http://www.defensecode.com/advisories/DC-2017-01-007_WordPress_Easy_Modal_Plugin_Advisory.pdf
• https://wordpress.org/plugins/easy-modal/#developers