{"id":"CVE-2021-24666","aliases":["EUVD-2021-11578","GHSA-2c3j-j92w-h38q"],"status":"published","title":"Podlove Podcast Publisher \u003c 3.5.6 - Unauthenticated SQL Injection","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.08883,"percentile":0.95288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2021-09-27T15:25:36Z","modified":"2026-10-20T10:54:33Z","exploits":[{"source":"nuclei","id":"CVE-2021-24666","title":"WordPress Podlove Podcast Publisher \u003c3.5.6 - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24666.yaml"}],"products":[{"vendor":"eric teubert","product":"podlove podcast publisher"},{"vendor":"podlove","product":"podlove_podcast_publisher"},{"vendor":"unknown","product":"podlove podcast publisher"}],"references":[{"url":"https://wpscan.com/vulnerability/fb4d7988-60ff-4862-96a1-80b1866336fe","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/podlove/podlove-publisher/commit/aa8a343a2e2333b34a422f801adee09b020c6d76","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24666"},{"url":"https://github.com/advisories/GHSA-2c3j-j92w-h38q"}],"sources":{"cve":[{"id":"CVE-2021-24666","title":"Podlove Podcast Publisher \u003c 3.5.6 - Unauthenticated SQL Injection","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","status":"published","published":"2021-09-27T15:25:36Z","modified":"2024-08-03T19:42:15.993Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-11578","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","status":"published","published":"2021-09-27T15:25:36Z","modified":"2024-08-03T19:42:15Z","updated_at":"2026-11-03T03:24:56.31224Z"}],"ghsa":[{"id":"GHSA-2c3j-j92w-h38q","title":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations'...","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","status":"published","published":"2022-05-24T19:15:48Z","modified":"2023-01-30T05:02:29Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:46:38.945282Z"}],"nvd":[{"id":"CVE-2021-24666","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","status":"published","published":"2021-09-27T16:15:09.107Z","modified":"2026-06-17T03:40:25.233Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:58.933037Z"}],"osv":[{"id":"CVE-2021-24666","description":"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social \u0026 Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P\u003cid\u003e[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.","status":"published","published":"2021-09-27T16:15:09.107Z","modified":"2026-10-20T10:54:33.564195303Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"}]}}