CVE-2017-1002010

Critical

Published: 14/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete_media function, allowing attackers to manipulate the database.

Risk Assessment

This vulnerability could lead to unauthorized access to database information, posing a serious threat to the integrity and confidentiality of data within the organization.

Recommendation

It is recommended to update the plugin to the latest version that fixes this vulnerability and to implement additional input sanitization mechanisms.

Original NVD description (English source)

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.