CVE-2015-4614

High

Published: 08/07/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The Easy2Map plugin before version 1.2.5 for WordPress contains multiple SQL injection vulnerabilities in includes/Function.php, allowing remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.

Risk Assessment

Attackers can exploit these vulnerabilities to gain unauthorized access to the database, potentially leading to data theft or system compromise.

Recommendation

It is recommended to update the Easy2Map plugin to the latest version to mitigate these vulnerabilities and conduct a security audit of the application.

Other vulnerabilities in Easy2Map plugin for WordPress

CVE-2015-7669Critical
The Easy2Map plugin before version 1.3.0 for WordPress contains multiple directory traversal vulnerabilities in the includes/MapImportCSV2.php and includes/MapImportCSV.php files, allowing remote attackers to include and execute arbitrary files via the csvfile parameter related to upload file functionality.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.