CVE-2021-24507 | BDVDB-2026-158385 Detail

Astra Pro Addon

Description#

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues

Impact#

No impact statement in the source data.

Weaknesses#

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References#

https://wpscan.com/vulnerability/a1a0dc0b-c351-4d46-ac9b-b297ce4d251c
https://wpastra.com/changelog/astra-pro-addon/

Exploit#

No public exploit known

History#

Version 12021-08-09Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.