CVE-2024-12428

Summary

CVE-2024-12428 is a newly disclosed vulnerability affecting the WP Data Access plugin for WordPress. This issue, which exists in all versions up to 5.5.22, allows unauthenticated attackers to inject SQL queries into the plugin's 'order[user_login][dir]' parameter. Due to insufficient escaping and preparation of user-supplied data, attackers can append malicious SQL queries to existing ones, potentially extracting sensitive information from the database. This vulnerability poses a significant risk to WordPress sites running the WP Data Access plugin and underscores the importance of timely updates and secure coding practices.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.