Vulnerability · Published Nov 8, 2021 · Assigned by WPScan
CVE-2021-24627G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection
High 7.2
In plain English
A high-severity SQL injection in G Auto-Hyperlink from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.5% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.2High
Exploit odds (30 days)6.5%top 6.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | G Auto-Hyperlink | 1.0.1 – through 1.0.1 |
Weakness: CWE-89