CVE-2017-12946

HIGH

easy_modal < 2.0.17 - Authenticated SQL Injection via id/ids/modal Parameter

Title source: llm
STIX 2.1

Description

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0126
EPSS Percentile 66.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
easymodal_project/easy_modal < 2.0.17
Published Aug 18, 2017
Tracked Since Feb 18, 2026