CVE-2023-0900

HIGH NUCLEI

Pricing Table Builder WordPress Plugin < 1.1.6 - Authenticated SQL Injection

Title source: llm

Exploitation Summary

CVE-2023-0900 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.

Nuclei Templates (1)

AP Pricing Tables Lite <= 1.1.6 - SQL Injection

HIGHVERIFIEDby r3Y3r53

Shodan: http.html:wp-content/plugins/ap-pricing-tables-lite

FOFA: body=wp-content/plugins/ap-pricing-tables-lite

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1

Scores

CVSS v3 7.2

EPSS 0.0323

EPSS Percentile 86.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

Status published

Products (1)

wpdevart/pricing_table_builder < 1.1.6

Published Jun 05, 2023

Tracked Since Feb 18, 2026