Back to search
CVE-2022-4154
Published: Dec 26, 2022
Modified: Apr 14, 2025
PUBLISHED
Description
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
| Vendor | Product | Versions |
|---|---|---|
Unknown | Contest Gallery Pro | affected 0 - < 19.1.5 |
References
https://wpscan.com/vulnerability/dac32ed4-d3df-420a-a2eb-9e7d2435826a
exploit
vdb-entry
technical-description
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now