CVE-2021-24860: BSK PDF Manager < 3.1.2 - Admin+ SQL Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-29 · updated 2026-06-17
Weakness: CWE-89

Description

The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue

Affected products

bannersky BSK PDF Manager: before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: bannersky BSK PDF Manager 3.1.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369
https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369

Get alerted when CVE-2021-24860 or the next vulnerability affects your stack