Plugin Organizer
Monthly
SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.
SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.