Mooberry Book Manager
Monthly
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.