high8.8
CVE-2020-12104
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file.
Impact
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Internet-Formation | Wp-Advanced-Search | before 3.3.7 |