Vulnerability · Published Nov 24, 2021 · Assigned by Patchstack

CVE-2021-36916WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

High 8.6

In plain English

A high-severity SQL injection in Hide My WP (WordPress plugin) from wpWave. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.9%top 20.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwp_get_user_ip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will be directly inserted into the SQL query, making SQL injection possible.

Affected products (as reported)

Vendor	Product	Versions
wpWave	Hide My WP (WordPress plugin)	<= 6.2.3 – through 6.2.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158 x_refsource_CONFIRM
https://patchstack.com/hide-my-wp-vulnerabilities-fixed/ x_refsource_MISC
https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-sql-injection-sqli-vulnerability x_refsource_MISC