CVE-2023-51547 WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection

What is CVE-2023-51547?

CVE-2023-51547 is a high-severity SQL injection vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin, published on 31 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.

Weakness: CWE-89

Which versions are affected by CVE-2023-51547?

It affects 1 product.

Products include Wpmanageninja Fluent Support.

How do I fix CVE-2023-51547?

No fix has been published for CVE-2023-51547 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-51547 being exploited?

There is no known exploitation of CVE-2023-51547 in the wild and no public exploit code.

Other vulnerabilities in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin

• CVE-2024-47304 WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability High 8.5
• CVE-2024-13568 Information disclosure in Fluent Support – Helpdesk & Customer Support Ticket System High 7.5
• CVE-2022-2559 Fluent Support < 1.5.8 - Admin+ SQLi High 7.2
• CVE-2024-47302 WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p492-mh45-jmr2.