CVE-2024-1981

Summary

CVE-2024-1981 is a newly disclosed vulnerability affecting the WPvivid plugin for WordPress. In versions prior to 0.9.68, the plugin is susceptible to SQL Injection attacks due to insufficient escaping of user-supplied data in the 'table_prefix' parameter. This issue permits unauthenticated attackers to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive information from the database. This vulnerability highlights the importance of input validation and prepared statements in WordPress plugins to prevent SQL Injection attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.