CVE-2023-1471 is an SQL Injection vulnerability affecting the WP Popup Banners plugin for WordPress, specifically in versions up to and including 1.2.5. This flaw allows authenticated attackers with low privileges, such as subscribers, to inject malicious SQL queries. The vulnerability stems from insufficient input sanitization and improper SQL query preparation, enabling attackers to extract sensitive information from the database. Rated with a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring only low privileges and no user interaction. The primary impact is high confidentiality, as attackers can access sensitive data. Currently, there is no evidence of active exploitation, nor are there publicly available Metasploit modules, Nuclei templates, or ExploitDB entries. Community discussion and media coverage are minimal, with only one mention and one article identified, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.2.5CPE matchmatch criteria | cpe:2.3:a:wp_popup_banners_project:wp_popup_banners:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.