CVE-2024-12015

Summary

CVE-2024-12015 is a new vulnerability that affects the 'Project Manager' WordPress Plugin. This issue permits authenticated attackers to inject malicious SQL code into the plugin via the 'orderby' parameter in the '/pm/v2/activities' route, potentially leading to unauthorized data access or modification. Attackers could exploit this vulnerability to gain administrative control over the WordPress site, causing significant harm. Users of the 'Project Manager' plugin are urged to update to the latest version as soon as possible to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.