Readabler
Monthly
SQL Injection in the Readabler WordPress plugin affects all versions prior to 2.0.18, allowing unauthenticated remote attackers to append malicious SQL clauses to existing database queries and exfiltrate sensitive data from the WordPress database. The flaw stems from insufficient escaping of user-supplied input combined with unprepared SQL queries inside the plugin. No active exploitation is confirmed at time of analysis, but the zero-authentication, low-complexity, network-accessible attack path makes this a practical target for automated mass scanning campaigns.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.
SQL Injection in the Readabler WordPress plugin affects all versions prior to 2.0.18, allowing unauthenticated remote attackers to append malicious SQL clauses to existing database queries and exfiltrate sensitive data from the WordPress database. The flaw stems from insufficient escaping of user-supplied input combined with unprepared SQL queries inside the plugin. No active exploitation is confirmed at time of analysis, but the zero-authentication, low-complexity, network-accessible attack path makes this a practical target for automated mass scanning campaigns.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.