Udesign Core
Monthly
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.