CVE-2024-2804

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-280408.8SQL injection vulnerability exists in GetDIAE_astListParameters.CVE-2024-280418.8HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command.CVE-2024-280428.4SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.CVE-2024-280445.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.CVE-2024-280455.4Improper neutralization of input within the affected product could lead to cross-site scripting.CVE-2024-280467.8Uncontrolled search path in some Intel(R) GPA software before version 2024.1 may allow an authenticated user to potentially enable escalatioCVE-2024-280475.3Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information discloCVE-2024-280489.8OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS cCVE-2024-280495.7Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before versCVE-2024-28058.8A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been rated as critical. Affected by this issue is the function foCVE-2024-280505.5Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated userCVE-2024-280512.2Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information dis