CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

• CWE-89

• http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.htmlExploit
• http://www.exploit-db.com/exploits/34781Exploit
• http://www.securityfocus.com/archive/1/533519/100/0/threaded
• http://www.securityfocus.com/bid/70150Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96204
• https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelogVendor Advisory
• https://www.htbridge.com/advisory/HTB23231Exploit
• http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.htmlExploit
• http://www.exploit-db.com/exploits/34781Exploit
• http://www.securityfocus.com/archive/1/533519/100/0/threaded
• http://www.securityfocus.com/bid/70150Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96204
• https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelogVendor Advisory
• https://www.htbridge.com/advisory/HTB23231Exploit

Published

Oct 2, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-6236Unspecified vulnerability in the LumoNet PHP Include (lumoph…
• CVE-2014-6237Cross-site scripting (XSS) vulnerability in the News Pack ex…
• CVE-2014-6238Cross-site scripting (XSS) vulnerability in the Akronymmanag…
• CVE-2014-6239SQL injection vulnerability in the Address visualization wit…
• CVE-2014-6240Cross-site scripting (XSS) vulnerability in the Google Sitem…
• CVE-2014-6241SQL injection vulnerability in the wt_directory extension be…
• CVE-2014-6243Cross-site scripting (XSS) vulnerability in the EWWW Image O…
• CVE-2014-6251Stack-based buffer overflow in CPUMiner before 2.4.1 allows …
• CVE-2014-6252Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.1…
• CVE-2014-6253Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-6254Multiple cross-site scripting (XSS) vulnerabilities in Zenos…
• CVE-2014-6255Open redirect vulnerability in the login form in Zenoss Core…