Quentn Wp
Monthly
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extract sensitive database information through a malicious 'qntn_wp_access' cookie value. All versions up to and including 1.2.12 are affected. With a CVSS score of 7.5 and requiring no authentication or user interaction, this represents a significant risk for WordPress sites using this plugin, though no active exploitation (KEV) or public proof-of-concept has been documented at this time.
Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators) to execute arbitrary SQL queries against the underlying database via an unsanitized parameter. Although the attack vector is network-accessible and no authentication bypass is needed, exploitation is constrained to administrators, significantly limiting real-world risk. A publicly available exploit code exists via WPScan, though EPSS remains very low at 0.16% (5th percentile), indicating no widespread opportunistic exploitation at time of analysis.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extract sensitive database information through a malicious 'qntn_wp_access' cookie value. All versions up to and including 1.2.12 are affected. With a CVSS score of 7.5 and requiring no authentication or user interaction, this represents a significant risk for WordPress sites using this plugin, though no active exploitation (KEV) or public proof-of-concept has been documented at this time.
Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators) to execute arbitrary SQL queries against the underlying database via an unsanitized parameter. Although the attack vector is network-accessible and no authentication bypass is needed, exploitation is constrained to administrators, significantly limiting real-world risk. A publicly available exploit code exists via WPScan, though EPSS remains very low at 0.16% (5th percentile), indicating no widespread opportunistic exploitation at time of analysis.