CVE-2023-5041 — Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logge…
Published: 2024-01-17 · CVSS: 8.8 · CVSS 3.1
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7