CVE-2021-24140 Ajax Load More < 5.3.2 - Authenticated SQL Injection
Authenticated attackers can execute arbitrary SQL commands via the repeater parameter in the Ajax Load More WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24140?
CVE-2021-24140 is a high-severity SQL injection vulnerability in Unknown Ajax Load More, published on 18 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.
Weakness: CWE-89
Which versions are affected by CVE-2021-24140?
It affects 1 product.
Products include Connekthq Ajax Load More.
How do I fix CVE-2021-24140?
No fix has been published for CVE-2021-24140 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-24140 being exploited?
There is no known exploitation of CVE-2021-24140 in the wild and no public exploit code.
Other vulnerabilities in Unknown Ajax Load More
- CVE-2015-10140 Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
- CVE-2022-2433 WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization
- CVE-2025-47630 WordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2023-50874 WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-8505 Cross-site scripting in Ajax Load More – Infinite Scroll, Load More, & Lazy Load
Sources
Also known as GHSA-w9hc-cq6j-8gqw.