CVE-2015-5308

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-11-02 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.

Affected products

WP Championship: 5.8

References

http://www.vapid.dhs.org/advisory.php?v=155
https://wpvulndb.com/vulnerabilities/8221
http://www.vapid.dhs.org/advisory.php?v=155
https://wpvulndb.com/vulnerabilities/8221

Get alerted when CVE-2015-5308 or the next vulnerability affects your stack