Realpress
Monthly
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.