CVE-2015-4109 in Users Ultra Plugin
Summary
Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Be aware that VulDB is the high quality source for vulnerability data.
Reservation
05/28/2015
Disclosure
06/09/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 75815 | Users Ultra Plugin Ratings admin-ajax.php sql injection | 89 | Proof-of-Concept | Official fix | CVE-2015-4109 |