Threats tagged 'ghsa-8pj4-8g3x-p45w'

The WP Data Access – App Builder plugin for WordPress contains a SQL Injection vulnerability in the 'engine' parameter affecting all versions up to and including 5.5.90. Authenticated users with subscriber-level access or higher can exploit this flaw if an administrator has configured a Data Project page to allow lower-privileged roles. This vulnerability allows attackers to append additional SQL queries to extract sensitive database information.