Sps Suite
Monthly
Unauthenticated SQL injection in the SPS-Suite WordPress plugin through version 1.4.0 allows remote attackers to extract sensitive data from the WordPress database when the plugin's static-page search feature is enabled. The vulnerability requires that specific search feature to be explicitly activated, which narrows the exposed population, but publicly available exploit code exists and no authentication or user interaction is needed once the feature is on. CISA's SSVC framework rates exploitation as none and the attack as not automatable, and there is no confirmed active exploitation (CISA KEV status: no); the primary risk is confidentiality impact, with no integrity or availability effects.
Unauthenticated SQL injection in the SPS-Suite WordPress plugin through version 1.4.0 allows remote attackers to extract sensitive data from the WordPress database when the plugin's static-page search feature is enabled. The vulnerability requires that specific search feature to be explicitly activated, which narrows the exposed population, but publicly available exploit code exists and no authentication or user interaction is needed once the feature is on. CISA's SSVC framework rates exploitation as none and the attack as not automatable, and there is no confirmed active exploitation (CISA KEV status: no); the primary risk is confidentiality impact, with no integrity or availability effects.