Description
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
Published: 2024-01-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-58614 The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
History

Wed, 13 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Artplacer Artplacer Widget
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-06-11T16:38:42.806Z

Reserved: 2023-11-28T19:03:20.950Z

Link: CVE-2023-6373

cve-icon Vulnrichment

Updated: 2024-08-02T08:28:21.796Z

cve-icon NVD

Status : Modified

Published: 2024-01-16T16:15:13.693

Modified: 2025-06-11T17:15:38.977

Link: CVE-2023-6373

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses