What’s Vulnerable › Vulnerabilities

CVE-2021-38324: SP Rental Manager <= 1.5.3 Unauthenticated SQL Injection

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-09 · updated 2026-06-17
• Weakness: CWE-89

Description

The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3.

Affected products

• SP Rental Manager: through 1.5.3

References

• https://plugins.trac.wordpress.org/browser/sp-rental-manager/tags/1.5.3/user/shortcodes.php#L389
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38324
• https://plugins.trac.wordpress.org/browser/sp-rental-manager/tags/1.5.3/user/shortcodes.php#L389
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38324

Get alerted when CVE-2021-38324 or the next vulnerability affects your stack