CVE-2024-6928

The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - contact@wpscan.com

Published

2024-09-08

Last modified

2024-09-10

Weaknesses

CWE-89

Affected products

• Opti Marketing (Opti.marketing)
• Opti Marketing (Optimarketing)
• Opti Marketing (Unknown)

References

• https://wpscan.com/vulnerability/7bb9474f-2b9d-4856-b36d-a43da3db0245/