Swift Performance Lite
Monthly
SQL injection in Swift Performance Lite before 2.3.7.4 allows authenticated users with author-level or higher privileges to execute arbitrary SQL queries, potentially exposing sensitive database contents. The flaw arises from missing sanitization and escaping of a value used in a SQL statement (CWE-89), and publicly available exploit code exists. Exploitation requires a valid author account on a site with the plugin active, which narrows the attack surface compared to unauthenticated flaws.
SQL injection in Swift Performance Lite before 2.3.7.4 allows authenticated users with author-level or higher privileges to execute arbitrary SQL queries, potentially exposing sensitive database contents. The flaw arises from missing sanitization and escaping of a value used in a SQL statement (CWE-89), and publicly available exploit code exists. Exploitation requires a valid author account on a site with the plugin active, which narrows the attack surface compared to unauthenticated flaws.