CVE-2024-11722

Summary

CVE-2024-11722 is a vulnerability affecting the Frontend Admin plugin by DynamiApps for WordPress. This issue allows unauthenticated attackers to perform SQL Injection attacks by manipulating the 'orderby' parameter. The cause is insufficient escaping on user-supplied input and inadequate preparation of SQL queries. By appending malicious queries, attackers can extract sensitive information from the database. To exploit this vulnerability, an unauthenticated user must have permission to view form submissions and the form submission shortcode must be added to a page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.