May 30, 2023, 8:15 a.m. |

National Vulnerability Database web.nvd.nist.gov

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site's database.

administrators amp api configuration cve database endpoint fast information input leak plugin query report sensitive information sql sql query wordpress wordpress plugin

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Information Technology Security Engineer

@ Plexus Worldwide | Scottsdale, Arizona, United States

Principal Email Security Researcher (Cortex XDR)

@ Palo Alto Networks | Tel Aviv-Yafo, Israel

Lead Security Engineer - Cloud Security, AWS

@ JPMorgan Chase & Co. | Bengaluru, Karnataka, India