CyberRota Analysis
AI-GeneratedThe CubeWP Framework WordPress plugin prior to version 1.1.31 is vulnerable to SQL injection due to inadequate sanitization and escaping of parameters in an AJAX action, coupled with a lack of capability checks. This flaw allows users with Subscriber-level access and above to execute arbitrary SQL queries, potentially compromising the integrity of the database. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.