Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-1893: The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficie...
CVE-2024-1893 · published 2 years ago
Summary
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
What to do
- Update realestateconnected easy_property_listings to version 3.5.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| realestateconnected | easy_property_listings |
< 3.5.3 cpe:2.3:a:realestateconnected:easy_property_listings:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficie...
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published9 Apr 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-1893 · NVD
Track software like this
Free during beta