CVE-2020-12104

The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
VendorProductVersion
internet-formationwp-advanced-search
𝑥
< 3.3.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://wordpress.org/plugins/wp-advanced-search/#developers
https://wpvulndb.com/vulnerabilities/10199
https://wordpress.org/plugins/wp-advanced-search/#developers
https://wpvulndb.com/vulnerabilities/10199