← Database

CVE-2021-38324

HIGH CVSS: 8.2 Published: 2021-09-09 Modified: 2026-06-17

Description

The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3.

Affected Platforms

Smartypantsplugins Sp Rental Manager

Weakness Type

CWE-89, CWE-89

References