CVE-2021-44779 - WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Back Back to CVE browser

CRITICAL

WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Published Feb 4, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.07%

Description

Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.

Affected products

Vendor G.J.P. Product n/a Default
n/a
- Version
  <= 2.3
  Status
  affected
  Constraints
  <=2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

G.J.P.

n/a

Version	Status	Constraints
<= 2.3	affected	<=2.3

Remediation

Vendor solution

Deactivate and delete. No patched version is available. The plugin was closed on the wordpress.org plugin repository.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31584
Advisory
https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-autoresponder-plugin-2-3-unauthenticated-sql-injection-sqli-vulnerability
x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/gwa-autoresponder/
x_refsource_CONFIRMProductThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31584		Advisory
https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-autoresponder-plugin-2-3-unauthenticated-sql-injection-sqli-vulnerability		x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/gwa-autoresponder/		x_refsource_CONFIRMProductThird Party Advisory