Not rated
CVE-2021-24747 The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the…
Description
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SEO Booster 3.8 | earliest → < 3.8 | 3.8 |