Vulnerability · Published Nov 8, 2021 · Assigned by WPScan
CVE-2021-24731Pie Register < 3.7.1.6 - Unauthenticated SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.4% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes | 3.7.1.6 – before 3.7.1.6 |
Weakness: CWE-89