Description
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.
References (2)
Core 2
Core References
Product x_refsource_confirm
http://wordpress.org/extend/plugins/mingle-forum/changelog/
Product x_refsource_confirm
http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum
Scores
EPSS
0.0151
EPSS Percentile
71.8%
Details
CWE
CWE-89
Status
published
Products (43)
cartpauj/mingle-forum
1.0.00
cartpauj/mingle-forum
1.0.01
cartpauj/mingle-forum
1.0.02
cartpauj/mingle-forum
1.0.03
cartpauj/mingle-forum
1.0.04
cartpauj/mingle-forum
1.0.05
cartpauj/mingle-forum
1.0.06
cartpauj/mingle-forum
1.0.07
cartpauj/mingle-forum
1.0.08
cartpauj/mingle-forum
1.0.09
... and 33 more
Published
Oct 08, 2012
Tracked Since
Feb 18, 2026