CVE-2021-39351 - Vulnerability Details - OpenCVE

The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wp Bannerize Project	Wp Bannerize

Configuration 1 [-]

cpe:2.3:a:wp_bannerize_project:wp_bannerize:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351

History

Fri, 14 Feb 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2021-10-06T15:22:00.606Z

Updated: 2025-02-14T18:24:43.170Z

Reserved: 2021-08-20T00:00:00.000Z

Link: CVE-2021-39351

Vulnrichment

Updated: 2024-08-04T02:06:42.261Z

NVD

Status : Modified

Published: 2021-10-06T16:15:07.490

Modified: 2025-02-14T19:15:13.407

Link: CVE-2021-39351

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "WP Bannerize", "vendor": "WP Bannerize", "versions": [{"status": "affected", "version": "2.0.0 - 4.0.2 4.0.2"}]}], "credits": [{"lang": "en", "value": "Margaux DABERT from Intrinsec"}], "datePublic": "2021-10-05T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-06T15:22:00.000Z", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351"}, {"tags": ["x_refsource_MISC"], "url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681"}], "solutions": [{"lang": "en", "value": "Uninstall plugin from site."}], "source": {"discovery": "EXTERNAL"}, "title": "WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "Wordfence", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-10-05T20:14:00.000Z", "ID": "CVE-2021-39351", "STATE": "PUBLIC", "TITLE": "WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WP Bannerize", "version": {"version_data": [{"version_affected": "=", "version_name": "2.0.0 - 4.0.2", "version_value": "4.0.2"}]}}]}, "vendor_name": "WP Bannerize"}]}}, "credit": [{"lang": "eng", "value": "Margaux DABERT from Intrinsec"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351", "refsource": "MISC", "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351"}, {"name": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681", "refsource": "MISC", "url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681"}]}, "solution": [{"lang": "en", "value": "Uninstall plugin from site."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:06:42.261Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681"}]}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-14T18:24:39.403342Z", "id": "CVE-2021-39351", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T18:24:43.170Z"}}]}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2021-39351", "datePublished": "2021-10-06T15:22:00.606Z", "dateReserved": "2021-08-20T00:00:00.000Z", "dateUpdated": "2025-02-14T18:24:43.170Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:06:42.261Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-39351", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-14T18:24:39.403342Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T18:23:34.673Z"}}], "cna": {"title": "WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Margaux DABERT from Intrinsec"}], "affected": [{"vendor": "WP Bannerize", "product": "WP Bannerize", "versions": [{"status": "affected", "version": "2.0.0 - 4.0.2 4.0.2"}]}], "solutions": [{"lang": "en", "value": "Uninstall plugin from site."}], "datePublic": "2021-10-05T00:00:00.000Z", "references": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351", "tags": ["x_refsource_MISC"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2021-10-06T15:22:00.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Margaux DABERT from Intrinsec"}], "source": {"discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "2.0.0 - 4.0.2", "version_value": "4.0.2", "version_affected": "="}]}, "product_name": "WP Bannerize"}]}, "vendor_name": "WP Bannerize"}]}}, "solution": [{"lang": "en", "value": "Uninstall plugin from site."}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351", "name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351", "refsource": "MISC"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681", "name": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-39351", "AKA": "Wordfence", "STATE": "PUBLIC", "TITLE": "WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-10-05T20:14:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2021-39351", "state": "PUBLISHED", "dateUpdated": "2025-02-14T18:24:43.170Z", "dateReserved": "2021-08-20T00:00:00.000Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2021-10-06T15:22:00.606Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp_bannerize_project:wp_bannerize:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0F16C964-F255-4B72-B2D1-CB304FF7D731", "versionEndIncluding": "4.0.2", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2."}, {"lang": "es", "value": "El plugin WP Bannerize de WordPress es vulnerable a una inyecci\u00f3n SQL autenticada por medio del par\u00e1metro id que se encuentra en el archivo ~/Classes/wpBannerizeAdmin.php, que permite a atacantes exfiltrar informaci\u00f3n confidencial de sitios vulnerables. Este problema afecta a versiones 2.0.0 - 4.0.2"}], "id": "CVE-2021-39351", "lastModified": "2025-02-14T19:15:13.407", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2021-10-06T16:15:07.490", "references": [{"source": "security@wordfence.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}