Post Voting System
Monthly
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
SQL injection in the Post Voting System WordPress plugin through version 1.0 allows an authenticated user to inject arbitrary SQL into a database query because an input parameter is neither sanitized nor escaped before use. Any low-privilege account (PR:L per the assessed CVSS vector) is sufficient, so on sites with open user registration the issue is practically reachable at scale, though exploitation is limited by the plugin's niche deployment and by the fact that a valid authenticated session is mandatory. Publicly available exploit code exists, but there is no confirmed active exploitation (SSVC Exploitation: none), so this should be treated as a genuine but modest-severity issue requiring prompt patching rather than emergency response.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
SQL injection in the Post Voting System WordPress plugin through version 1.0 allows an authenticated user to inject arbitrary SQL into a database query because an input parameter is neither sanitized nor escaped before use. Any low-privilege account (PR:L per the assessed CVSS vector) is sufficient, so on sites with open user registration the issue is practically reachable at scale, though exploitation is limited by the plugin's niche deployment and by the fact that a valid authenticated session is mandatory. Publicly available exploit code exists, but there is no confirmed active exploitation (SSVC Exploitation: none), so this should be treated as a genuine but modest-severity issue requiring prompt patching rather than emergency response.