CVE-2021-24630

HIGH

Schreikasten < 0.14.18 - Authenticated SQL Injection via id GET Parameter

Title source: llm
STIX 2.1

Description

The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/a0787dae-a4b7-4248-9960-aaffabfaeb9f
Exploit, Third Party Advisory x_refsource_misc
https://codevigilant.com/disclosure/2021/wp-plugin-schreikasten/

Scores

CVSS v3 8.8
EPSS 0.0152
EPSS Percentile 71.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
schreikasten_project/schreikasten < 0.14.18
Published Nov 08, 2021
Tracked Since Feb 18, 2026