Site Setup Wizard
Monthly
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).