Wp Verify Api
Monthly
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Missing authorization on a REST route in the WP Verify API WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to insert arbitrary data into the plugin's own database table and to make the affected site dispatch templated verification emails to any email address they choose. Because the route has no permission callback and no rate limiting, it can be driven repeatedly and at scale, though impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) rather than data disclosure or denial of service. Publicly available exploit code exists and the issue was reported via WPScan, but there is no confirmation of active exploitation (CISA SSVC exploitation: none) and the practical exposure is constrained by the plugin's low adoption rate.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Missing authorization on a REST route in the WP Verify API WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to insert arbitrary data into the plugin's own database table and to make the affected site dispatch templated verification emails to any email address they choose. Because the route has no permission callback and no rate limiting, it can be driven repeatedly and at scale, though impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) rather than data disclosure or denial of service. Publicly available exploit code exists and the issue was reported via WPScan, but there is no confirmation of active exploitation (CISA SSVC exploitation: none) and the practical exposure is constrained by the plugin's low adoption rate.