CVE-2024-2879
Last modified
CVE-2024-2879 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.. EPSS estimates a 18.40% chance of exploitation in the next 30 days.
Description
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kreaturamedia | Layerslider | 7.9.11 |
| Kreaturamedia | Layerslider | 7.10.0 |
References
- https://layerslider.com/release-log/Release Notes
- https://layerslider.com/release-log/Release Notes
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-2879?
How severe is CVE-2024-2879?
How do I fix CVE-2024-2879?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-28780IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Cont…5.9
- CVE-2024-28781IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through…5.4
- CVE-2024-28782IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IB…6.5
- CVE-2024-28784IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. T…5.4
- CVE-2024-28786IBM QRadar SIEM 7.5 transmits sensitive or security-critical…6.5
- CVE-2024-28787IBM Security Verify Access 10.0.0 through 10.0.7 and IBM App…10
- CVE-2024-28793IBM Engineering Workflow Management 7.0.2 and 7.0.3 is vulne…5.4
- CVE-2024-28794IBM InfoSphere Information Server 11.7 is vulnerable to cros…5.4
- CVE-2024-28795IBM InfoSphere Information Server 11.7 is vulnerable to cros…5.4
- CVE-2024-28796IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to sto…5.4
- CVE-2024-28797IBM InfoSphere Information Server 11.7 is vulnerable stored …5.4
- CVE-2024-28798IBM InfoSphere Information Server 11.7 is vulnerable to stor…6.1
Are you affected by CVE-2024-2879?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST