CyberSec.Space Logo
Back to CVE Browser

CVE-2020-13640

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0740%
EPSS Percentile25.70th
PublishedJun 18, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Affected Platforms (CPE)

📦
Gvectors

Wpdiscuz

<= 5.3.5

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2020/07/06/1
🔗 https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/5.3.6
🔗 https://plugins.trac.wordpress.org/changeset/2323200
🔗 https://wordpress.org/plugins/wpdiscuz/#developers
🔗 https://wpdiscuz.com/community/news/security-vulnerability-issue-in-5-3-5-please-udate/
🔗 http://www.openwall.com/lists/oss-security/2020/07/06/1
🔗 https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/5.3.6
🔗 https://plugins.trac.wordpress.org/changeset/2323200

Related Vulnerabilities

CVE-2020-2418610.0

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthe...

CVE-2021-247374.8

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages befor...

CVE-2021-248064.3

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attac...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...