Description
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2660225
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2680906
Scores
CVSS v3
9.8
EPSS
0.0200
EPSS Percentile
78.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (2)
bmarshall511/wordpress_zero_spam
0 - 5.2.13Packagist
highfivery/zero-spam
< 5.2.11
Published
Mar 14, 2022
Tracked Since
Feb 18, 2026