CVE-2023-2636
AN_GradeBook <= 5.0.1 - Subscriber+ SQLi
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 3.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
11 Jun 2023Public PoC
17 Jul 2023Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
Affected products
Unknown · AN_GradeBookpublic PoCs found — 4
githubgithub.com/lukinneberg/CVE-2023-2636★ 1cve_referencepacketstormsecurity.com/files/173815/WordPress-AN_Gradebook-5.0.1-SQL-Injection.htmlunverifiedcve_referencewpscan.com/vulnerability/6a3bfd88-1251-4d40-b26f-62950a3ce0b5unverifiedexploitdbwww.exploit-db.com/exploits/51632unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →