Vulnerability · Published Aug 23, 2021 · Assigned by WPScan
CVE-2021-24554Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection
High 7.2
In plain English
A high-severity SQL injection in Paytm – Donation Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.2High
Exploit odds (30 days)6.6%top 6.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Paytm – Donation Plugin | 1.3.2 – through 1.3.2 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/f2842ac8-76fa-4490-aa0c-5f2b07ecf2ad x_refsource_MISC
- https://codevigilant.com/disclosure/2021/wp-plugin-wp-paytm-pay/ x_refsource_MISC