Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-24864: The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue

CVE-2021-24864 · published 4 years ago

Summary

The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue

What to do

Update wpscan wp_cloudy to version 4.4.9 or later.

Affected software

Vendor	Product	Affected versions
wpscan	wp_cloudy	< 4.4.9 `cpe:2.3:a:wpscan:wp_cloudy::::::wordpress::*`

Original advisory text

The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue

References

https://plugins.trac.wordpress.org/changeset/2615400 Release Notes Third Party Advisory
https://wpscan.com/vulnerability/e3b9ee9f-602d-4e9d-810c-e1e3ba604464 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published28 Feb 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-24864 · NVD

Track software like this

Free during beta