CVE-2023-5203
WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection
Vexday Risk Score
36Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 7.5EPSS 2.2%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
26 Dec 2023Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · WP Sessions Time Monitoring Full AutomaticWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →