NetSight
IP …
critical9.8Public exploit code

CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_quest…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.

Affected products

VendorProductAffected versions
GetperfectsurveyPerfect Survey
before 1.5.2

Weakness classification

CWE-89

References