CVE-2020-27615 SQL injection in n/a
An SQL injection vulnerability in the Loginizer WordPress plugin allows attackers to execute arbitrary SQL commands and potentially cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27615?
CVE-2020-27615 is a critical SQL injection vulnerability in n/a, published on 21 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
Weakness: CWE-89
Which versions are affected by CVE-2020-27615?
It affects 1 product.
Products include Loginizer Loginizer.
How do I fix CVE-2020-27615?
No fix has been published for CVE-2020-27615 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-27615 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-27615 exists.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2017-12650 SQL injection in n/a
- CVE-2017-12651 Cross-site request forgery in n/a
- CVE-2024-10097 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2022-45084 WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2296 Loginizer 1.7.8 - Reflected XSS
Sources
Also known as GHSA-vf5c-prqq-g9f7.