CVE-2014-5182

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-08-06 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.

Affected products

Ostenta Yawpp: 1.2

References

http://codevigilant.com/disclosure/wp-plugin-yawpp-a1-injection
http://wordpress.org/plugins/yawpp/changelog/
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=834445%40yawpp&old=824042%40yawpp&sfp_email=&sfph_mail=#file36
http://codevigilant.com/disclosure/wp-plugin-yawpp-a1-injection
http://wordpress.org/plugins/yawpp/changelog/
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=834445%40yawpp&old=824042%40yawpp&sfp_email=&sfph_mail=#file36

Get alerted when CVE-2014-5182 or the next vulnerability affects your stack