Vulnerability · Published Oct 6, 2021 · Assigned by Wordfence
CVE-2021-39351WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection
High 7.7
In plain English
A high-severity SQL injection in WP Bannerize from WP Bannerize. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)1.1%top 33.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WP Bannerize | WP Bannerize | 2.0.0 - 4.0.2 4.0.2 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N