Wpbulky
Monthly
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.