WordPress security changelog
HIGH CVE-2021-24860 Modified

BSK PDF Manager: SQL injection

BSK PDF Manager is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

CVE / CNA score 7.2 CVSS · contact@wpscan.com
NVD score 7.2 CVSS 3.1 · nvd@nist.gov
Component
BSK PDF Manager
Plugin slug
bsk-pdf-manager
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Nov 29, 2021
Weakness
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Nov 29, 2021 and is one of 7 known issues for this plugin.

What to do

Patch or disable the affected component.

Update BSK PDF Manager to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue

NVD vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources