Vulnerability · Published Dec 20, 2023 · Assigned by Patchstack
CVE-2023-32590WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
Critical 9.3
In plain English
A critical-severity SQL injection in Subscribe to Category from Daniel Söderström / Sidney van de Stouwe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)1.8%top 21.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Daniel Söderström / Sidney van de Stouwe | Subscribe to Category | n/a – through 2.7.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L