CVE-2023-0900

HIGH NUCLEI

Wpdevart Pricing Table Builder < 1.1.6 - SQL Injection

Title source: rule

Description

The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.

Nuclei Templates (1)

AP Pricing Tables Lite <= 1.1.6 - SQL Injection

HIGHVERIFIEDby r3Y3r53

Shodan: http.html:wp-content/plugins/ap-pricing-tables-lite

FOFA: body=wp-content/plugins/ap-pricing-tables-lite

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1

Scores

CVSS v3 7.2

EPSS 0.0638

EPSS Percentile 91.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (1)

wpdevart/pricing_table_builder < 1.1.6

Published Jun 05, 2023

Tracked Since Feb 18, 2026