CVE-2015-7670

Critical

Published: 26/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Support Ticket System plugin for WordPress before version 1.2.1 contains multiple SQL injection vulnerabilities in includes/update.php, allowing remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.

Risk Assessment

An attacker could exploit these vulnerabilities to gain access to the database, potentially leading to data theft or system compromise.

Recommendation

It is recommended to update the plugin to the latest version to mitigate these vulnerabilities and conduct a security audit of the database.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.