Description
Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.
References (2)
Core 2
Core References
Exploit, Vendor Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/8221
Exploit x_refsource_misc
http://www.vapid.dhs.org/advisory.php?v=155
Scores
EPSS
0.0221
EPSS Percentile
80.7%
Details
CWE
CWE-89
Status
published
Products (1)
wp-championship_project/wp-championship
5.8
Published
Nov 02, 2015
Tracked Since
Feb 18, 2026