Description
Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped -idsignup- POST parameter. Attackers can send crafted requests to the admin-ajax.php endpoint with malicious SQL payloads in the -idsignup- parameter to read arbitrary data from the database.
CVSS 8.2EPSS 0.27%Risk 0.84
View source- Published
- 2026-06-09 13:16:34
- Affected versions
- <2.1
- Type
- Installed app
- Last modified
- 2026-07-21 07:10:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N