CVE-2023-1730

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks

9.8

CVSS

40.6%

EPSS (exploit prob.)

99th

EPSS percentile

2023-05-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
supportcandy	supportcandy	< 3.1.5

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7
https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-1730