CVE-2021-26609 WordPress Mangboard SQL-Injection vulnerability

High 7.5 Published 26 Oct 2021 Updated 3 Aug 2024

A SQL injection vulnerability in the Mangboard WordPress plugin allows remote attackers to steal user information via the order_type parameter.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-26609?

CVE-2021-26609 is a high-severity SQL injection vulnerability in WordPress Mangboard, published on 26 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information.

Weakness: CWE-89

Which versions are affected by CVE-2021-26609?

It affects 1 product.

Products include Mangboard Mang Board.

How do I fix CVE-2021-26609?

No fix has been published for CVE-2021-26609 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-26609 being exploited?

There is no known exploitation of CVE-2021-26609 in the wild and no public exploit code.

Sources

Also known as GHSA-wxc6-647p-vgf6.