What’s Vulnerable › Vulnerabilities

CVE-2021-24748: Email Before Download < 6.8 - Admin+ SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-89

Description

The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues

Affected products

• M&S Consulting Email Before Download: before 6.8 — fixed in 6.8

How to fix

Upgrade to a fixed version: M&S Consulting Email Before Download 6.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a8625b84-337d-4c4d-a698-73e59d1f8ee1
• https://wpscan.com/vulnerability/a8625b84-337d-4c4d-a698-73e59d1f8ee1

Get alerted when CVE-2021-24748 or the next vulnerability affects your stack