CVE-2012-5328

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-08 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.

Affected products

cartpauj Mingle-Forum: through 1.0.32.1; 1.0.00, 1.0.01, 1.0.02, 1.0.03, 1.0.04, 1.0.05 (+36)

References

http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum
http://wordpress.org/extend/plugins/mingle-forum/changelog/
http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum
http://wordpress.org/extend/plugins/mingle-forum/changelog/

Get alerted when CVE-2012-5328 or the next vulnerability affects your stack