Threats tagged 'ghsa-cxh3-2w2w-7cgr'

The SliceWP Affiliates plugin for WordPress, versions up to and including 1.2.14, contains a SQL Injection vulnerability via the 'email' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient escaping and preparation of user input. The vulnerability is triggered during WooCommerce My Account registration via the user_register hook, which can be accessed without an account using a guest-obtainable nonce.