Threats tagged 'ghsa-vfgp-2gcg-5hrw'

The Give - Peer-to-Peer plugin for WordPress versions up to and including 2.9.3 contains a time-based SQL Injection vulnerability via the 'sort' parameter. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. Exploitation requires at least one active Peer-to-Peer campaign. The vulnerability can be chained with another (CVE-2026-82663) to achieve unauthenticated remote code execution.