Tcard Wp
Monthly
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.