CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Affected products

Wpdiscuz

Gvectors Wpdiscuz

≤ 5.3.5

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

12.6% (96th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2020-06-18