CVE-2016-20065 — Product Catalog 8 1.2 Plugin WordPress SQL Injection
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious …
Published: 2026-06-09 · CVSS: 8.8 · CVSS 4.0
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7