onOffice for WP-Websites SQL Injection Vulnerability in WordPress Plugin
Vulnerability
A SQL injection vulnerability has been identified in the onOffice for WP-Websites WordPress plugin, affecting all versions through 5.7. The vulnerability arises from inadequate escaping of user-supplied data in the 'order' parameter, allowing authenticated attackers with Editor-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information in the database.
Impact
Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to extract sensitive data from the database.
Remediation
No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.