CVE-2024-31370
AIKit for WordPress SQL injection
SQL injection discovered and reported in the AIKit WordPress plugin.
Technical summary
AIKit is a commercial WordPress writing-assistant plugin. A parameter it accepts is used in an SQL statement without being neutralised.
The published vector puts privileges required at low, so a low-privileged authenticated user is enough — a materially lower bar than the administrator-only cases elsewhere on this index, which is why the published score is the highest of the WordPress entries here.
Impact
A low-privileged authenticated user can read data from the WordPress database beyond what their role permits, including other users’ records.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-using-gpt3. This issue affects AIKit: from n/a through <= 4.14.1.
Published severity
| Published by | Version | Base score | Vector |
|---|---|---|---|
| Patchstack (CNA) | CVSS 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L |
References
Credit
Researcher: Ivan Spiridonov
Credited in the CVE record as “Ivan Spiridonov | Patchstack Bug Bounty Program”.
This is the work we do commercially
Vulnerability research and penetration testing by the same engineers who found this issue. Every report carries reproduction steps, impact and a retest.
Vulnerability researchPenetration testingGet the sample report
We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.
How we disclose
Every issue here was reported to the vendor or to a coordinating programme before publication. We publish only once a fix is available or the coordinated disclosure window has elapsed.
Want this kind of scrutiny on your own software?
Tell us what you want to protect. A senior tester will help you agree the scope and next steps. We usually reply within one business day.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy