Vulnerability · Published May 17, 2021 · Assigned by WPScan
CVE-2021-24314Goto < 2.1 - Unauthenticated Blind SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Goto from BoostifyThemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.9%top 19.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BoostifyThemes | Goto | 2.1 – before 2.1 |
Weakness: CWE-89