Captivate Sync
Monthly
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.