High severity · published Nov 29, 2021
CVE-2021-24748
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to…
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EB
Email Before Download · Mandsconsulting
before 6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24748
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24748
Exploit
https://wpscan.com/vulnerability/a8625b84-337d-4c4d-a698-73e59d1f8ee1
More from Email Before Download
8.8
CVE-2024-23519
WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)