CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks

Score

CVSS 3.1 4.5 Medium

Status

Analyzed - contact@wpscan.com

Published

2024-04-26

Last modified

2024-08-01

Weaknesses

CWE-89

Affected products

• Enl-newsletter (Enl Newsletter Plugin Project)
• Enl Newsletter (Unknown)
• Enl Newsletter (Wordpress)

References

• https://wpscan.com/vulnerability/7740646d-f3ea-4fc7-b35e-8b4a6821e178/