Media Sweep Wordpress Media Cleaner
Monthly
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.