{"id":"CVE-2014-6242","aliases":["EUVD-2014-6128","GHSA-f499-3q8w-php5"],"status":"published","title":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8...","description":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04155,"percentile":0.90936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2014-10-02T14:00:00Z","modified":"2026-06-17T00:12:46Z","exploits":[{"source":"exploitdb","id":"EDB-34781","title":"WordPress Plugin All In One WP Security 3.8.2 - SQL Injection","type":"webapps","platform":"php","date":"2014-09-25","url":"https://www.exploit-db.com/exploits/34781"}],"products":[{"vendor":"tips_and_tricks_hq","product":"all_in_one_wordpress_security_and_firewall"}],"references":[{"url":"http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/34781","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://www.securityfocus.com/bid/70150","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"https://www.htbridge.com/advisory/HTB23231","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securityfocus.com/archive/1/533519/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/96204","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6242"},{"url":"https://github.com/advisories/GHSA-f499-3q8w-php5"}],"sources":{"cve":[{"id":"CVE-2014-6242","description":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","status":"published","published":"2014-10-02T14:00:00Z","modified":"2024-08-06T12:10:12.73Z","updated_at":"2026-11-02T14:33:44.930749Z"}],"euvd":[{"id":"EUVD-2014-6128","description":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","status":"published","published":"2014-10-02T14:00:00Z","modified":"2024-08-06T12:10:12Z","updated_at":"2026-11-03T01:57:00.015932Z"}],"ghsa":[{"id":"GHSA-f499-3q8w-php5","title":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8...","description":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","status":"published","published":"2022-05-14T02:51:19Z","modified":"2023-02-02T05:07:04Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:52:25.351057Z"}],"nvd":[{"id":"CVE-2014-6242","description":"Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","status":"published","published":"2014-10-02T14:55:04.823Z","modified":"2026-06-17T00:12:46.033Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:56.266125Z"}]}}