CVE-2016-20065

HighCVSS 8.2

Published: 09/06/2026(UTC)Updated: 09/06/2026(UTC)Translated: 10/06/2026(UTC)NVD NIST

Summary

The Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter.

Risk Assessment

Attackers can extract sensitive database information from WordPress tables, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to update the plugin to the latest version and monitor server logs for suspicious activity.

Original NVD description (English source)

Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.