CVE-2017-1002009

Critical

Published: 14/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete function, allowing an attacker to manipulate SQL queries.

Risk Assessment

This vulnerability could lead to unauthorized access to the database and exposure of sensitive information. An attacker could exploit this flaw to execute arbitrary SQL queries.

Recommendation

It is recommended to update the plugin to the latest version that fixes this vulnerability. Additionally, implementing input sanitization mechanisms in the application is advisable.

Original NVD description (English source)

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.