CVE-2012-5853
high
CVSS v3
—
CVSS v2
7.5
VIR risk
7.5
Description
SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srch_txt parameter in a "the_search_text" action to wp-admin/admin-ajax.php.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| vinojcardoza | ajax_post_search | {"endExcluding":"1.3"} | 1.3 |
References
CWEs
CWE-89
Verify integrity in audit chain (admin only). AS-IS.