Live Copy Paste For Elementor
Monthly
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.