Vulnerability · Published Sep 13, 2021 · Assigned by WPScan
CVE-2021-24727Block and Stop Bad Bots < 6.60 - Authenticated SQL Injections
High 8.8
In plain English
A high-severity SQL injection in WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots | 6.60 – before 6.60 |
Weakness: CWE-89
References
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174 x_refsource_MISC
- https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2576276/ x_refsource_CONFIRM