CVE-2021-4450

Post Grid <= 2.1.12 - Contributor+ SQL Injection

The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

We have discovered 1 live websites that are affected by CVE-2021-4450.

Contact us to get more info



Affected Software

Product  Post Grid
Category Wordpress Plugins
Vulnerable Domains1 live websites (0.96% of Post Grid install base)
Vulnerable Versions
  • from 0 before 2.1.13
Vulnerable Versions Count1 versions ( 2.00% of all versions)


Common Weakness Enumeration

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')



Details

  • Published - Oct 16, 2024
  • Updated - Oct 16, 2024

Credits

  • Chloe Chamberland (finder)

CVE-2021-4450 usage by Country

United States1 websites

CVE-2021-4450 usage by TLD

.com1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-4450

Top websites that are affected by CVE-2021-4450. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com United States**,***,***
See full domain list

FAQ

CVE-2021-4450 is Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Post Grid
A total of 1 websites have been identified as vulnerable to CVE-2021-4450, discovered through global website indexing conducted by WebTechSurvey.
Post Grid is susceptible to CVE-2021-4450 vulnerability.
Post Grid versions before 2.1.13 are vulnerable to CVE-2021-4450.
Version 2.1.13 of Post Grid addresses the CVE-2021-4450 security vulnerability.