Nirweb support <= 2.7.9 is vulnerable to Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated

Published
2022-05-01

The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection

CVE

https://www.cve.org/CVERecord?id=CVE-2022-0781

CVSS

Score:8.3

Severity:High

Version: 2.7.9

There is a patch available in v2.8.2 and we strongly recommend you update to this version as soon as possible.