High severity · published May 5, 2020
CVE-2020-12104
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wp-advanced-search · Internet-formation
before 3.3.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12104
Product
https://wordpress.org/plugins/wp-advanced-search/#developers
Third Party Advisory
https://wpvulndb.com/vulnerabilities/10199
More from Wp-advanced-search
9.8
CVE-2024-9796
WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection
8.8
CVE-2022-47447
WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)
3.5
CVE-2024-10554
WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSS