CVE-2017-14507
CriticalSummary
The Content Timeline plugin version 4.4.2 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the timeline and id parameters in the respective PHP files.
Risk Assessment
These vulnerabilities could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update the Content Timeline plugin to the latest version to mitigate these vulnerabilities and conduct a security audit of the database.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.