CVE-2024-13500

Summary

CVE-2024-13500: This vulnerability affects the WP Project Manager plugin used for task, team, and project management in WordPress. The flaw, present in versions up to 2.6.17, stems from insufficient escaping of user-supplied data in the 'orderby' parameter. Attackers with Subscriber access or higher can exploit this vulnerability by appending SQL queries to existing ones, potentially extracting sensitive information from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.