Threats tagged 'ghsa-66pc-wp83-p27g'

The Customer Engagement System WordPress plugin versions before 2.0.2 contain a SQL injection vulnerability. This flaw arises because the plugin does not safely construct SQL statements for storing popup visibility rules, directly concatenating user-supplied ID values into an INSERT query without parameter binding or integer casting. An authenticated administrator can exploit this to inject arbitrary SQL and read the WordPress database contents.