Description
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the -post- parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious -post- values to extract sensitive database information or modify data.
CVSS 7.1EPSS 0.22599999999999998%Risk 0.72
View source- Published
- 2026-06-15 14:16:32
- Affected versions
- <=3.8.2
- Type
- Web application
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N