CVE-2021-24753: Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-27 · updated 2026-06-17
Weakness: CWE-89

Description

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue

Affected products

starfishwp Rich Reviews by Starfish: before 1.9.6 — fixed in 1.9.6

How to fix

Upgrade to a fixed version: starfishwp Rich Reviews by Starfish 1.9.6. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2624882/
https://wpscan.com/vulnerability/be7b102f-3982-46bd-a79c-203498f7c820
https://plugins.trac.wordpress.org/changeset/2624882/
https://wpscan.com/vulnerability/be7b102f-3982-46bd-a79c-203498f7c820

Get alerted when CVE-2021-24753 or the next vulnerability affects your stack