CVEs-PoC/2021/CVE-2021-24669.md

CVE-2021-24669

Description

The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.

POC

Reference

• https://wpscan.com/vulnerability/b97afbe8-c9ae-40a2-81e5-b1d7a6b31831
• https://wpscan.com/vulnerability/b97afbe8-c9ae-40a2-81e5-b1d7a6b31831

Github

No PoCs found on GitHub currently.