If So Dynamic Content Personalization
Monthly
SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.
SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.