Wp Shortcut Link And Advertisement Baner
Monthly
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.