CVE-2024-4145

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).

Score

CVSS 3.1 7.2 High

Status

Modified - contact@wpscan.com

Published

2024-06-13

Last modified

2024-08-01

Weaknesses

CWE-89

Affected products

• Search Replace (Unknown)
• Search & Replace (Wp-media)
• Seach And Replace (Wp Media Sas)

References

• https://wpscan.com/vulnerability/7d5b8764-c82d-4969-a707-f38b63bcadca/