Threats tagged 'ghsa-fw9r-r3mq-2mc5'

The WP Project Manager WordPress plugin up to version 2.6.26 contains a time-based SQL Injection vulnerability in the 'completed_at_operator' parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. Exploitation can lead to unauthorized extraction of sensitive database information.