cleverplugins vulnerabilities and threats

The SEO Booster plugin for WordPress versions up to and including 7.4.7 has a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to manipulate certain site options related to Google Search Console integration by exploiting a lack of capability checks in the handle_oauth_callback() function. Attackers can overwrite access tokens and email options, disrupting integration and injecting attacker-controlled data. The vulnerability has a medium severity rating with a CVSS score of 4.3.

The SEO Booster plugin for WordPress contains a SQL Injection vulnerability in the 'sort_field' parameter in all versions up to and including 7.3.1. This flaw allows authenticated users with administrator-level privileges or higher to inject additional SQL commands due to insufficient input sanitization. The vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 4.9, indicating a medium severity level.

The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Although esc_sql() and sanitize_text_field() are applied, neither neutralizes SQL keywords, commas, parentheses, or subquery syntax in an unquoted ORDER BY context, leaving the clause fully attacker-controlled.

Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.

Cross-Site Request Forgery (CSRF) vulnerability in cleverplugins.Com SEO Booster.This issue affects SEO Booster: from n/a through 3.8.9.