Threats tagged 'ghsa-v78j-qmj4-q3xm'

The WebToffee WP Backup and Migration plugin for WordPress versions up to and including 1.6.1 contains a generic SQL Injection vulnerability via the 'description' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient escaping and preparation of the SQL statement. Exploitation requires an administrator to perform a local database export and restore operation, which is the plugin's primary function. The attacker cannot trigger the vulnerability without administrator action.