CVE-2023-2608

The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912909%40multiple-pages-generator-by-porthas&new=2912909%40multiple-pages-generator-by-porthas&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912909%40multiple-pages-generator-by-porthas&new=2912909%40multiple-pages-generator-by-porthas&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=cveThird Party Advisory

Published

May 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26073An issue was discovered in Samsung Mobile Chipset and Baseba…9.8
• CVE-2023-26074An issue was discovered in Samsung Mobile Chipset and Baseba…9.8
• CVE-2023-26075An issue was discovered in Samsung Mobile Chipset and Baseba…9.8
• CVE-2023-26076An issue was discovered in Samsung Mobile Chipset and Baseba…9.8
• CVE-2023-26077Atera Agent through 1.8.3.6 on Windows Creates a Temporary F…7.8
• CVE-2023-26078Privilege escalation vulnerability was discovered in Atera A…7.8
• CVE-2023-26081In Epiphany (aka GNOME Web) through 43.0, untrusted web cont…7.5
• CVE-2023-26083Memory leak vulnerability in Mali GPU Kernel Driver in Midga…3.3
• CVE-2023-26084The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib bef…3.7
• CVE-2023-26085A possible out-of-bounds read and write (due to an improper …7.8
• CVE-2023-26088In Malwarebytes before 4.5.23, a symbolic link may be used d…7.8
• CVE-2023-26089European Chemicals Agency IUCLID 6.x before 6.27.6 allows au…9.8