Database Collation Fix
Monthly
Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.