Threats tagged 'ghsa-8p5f-q54f-ww8c'

The Duplicator and duplicator-pro WordPress plugins before version 5.1.0 have a vulnerability where the database charset and collation rewrite during a restore operation is not properly restricted to schema statements. This flaw allows a Subscriber user to inject SQL code into the restore's INSERT statement by storing crafted values in their profile, potentially leading to SQL injection when an administrator restores a backup on a server missing certain charsets or collations.