CVE-2015-2292

Yoast Wordpress Seo < 1.5.6 - SQL Injection

Title source: rule
STIX 2.1

Description

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Ryan Dewhurst · textwebappsphp
https://www.exploit-db.com/exploits/36413

References (7)

Core 7
Core References
Vendor Advisory x_refsource_confirm
https://yoast.com/wordpress-seo-security-release/
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/36413/
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Mar/73
Exploit vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031920

Scores

EPSS 0.0677
EPSS Percentile 91.4%

Details

CWE
CWE-89
Status published
Products (11)
yoast/wordpress_seo 1.6.0
yoast/wordpress_seo 1.6.1
yoast/wordpress_seo 1.6.2
yoast/wordpress_seo 1.6.3
yoast/wordpress_seo 1.7.1
yoast/wordpress_seo 1.7.2
yoast/wordpress_seo 1.7.3
yoast/wordpress_seo 1.7.3.1
yoast/wordpress_seo 1.7.3.2
yoast/wordpress_seo 1.7.3.3
... and 1 more
Published Mar 17, 2015
Tracked Since Feb 18, 2026