CVE-2021-24484
HIGHSecure Copy Content Protection and Content Locking < 2.6.7 - SQL Injection via get_reports() orderby Parameter
Title source: llmDescription
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/9ce0153d-4a8b-4215-b6b6-15ca68c4f52c
Scores
CVSS v3
7.2
EPSS
0.0134
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
ays-pro/secure_copy_content_protection_and_content_locking
< 2.6.7
Published
Aug 02, 2021
Tracked Since
Feb 18, 2026