1. Home
  2. CVE Database
  3. CVE-2021-24791
HIGH · 7.2

CVE-2021-24791

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets a...

Vulnerability Description

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
DraftpressHeader Footer Code Manager< 1.1.14

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2021-24791?

CVE-2021-24791 is a vulnerability with a CVSS score of 7.2 (HIGH). The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets a...

How severe is CVE-2021-24791?

CVE-2021-24791 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24791?

Check the references section above for vendor advisories and patch information. Affected products include: Draftpress Header Footer Code Manager.