What is CVE-2015-4018?

CVE-2015-4018 is tracked as a SQL Injection issue affecting the Plugin FeedWordPress.

Which FeedWordPress versions are affected?

The primary affected range is Versions before 2015.0514.

How should operators remediate CVE-2015-4018?

Update to 2015.0514 or newer where that release is compatible with the site.

Vulnerability Report

Plugin Critical Patch path listed CVE-2015-4018

FeedWordPress < 2015.0514 - SQL Injection

SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.

Quick Answer

CVE-2015-4018 is a critical severity with CVSS 9.8 SQL Injection issue affecting the Plugin FeedWordPress. It affects Versions before 2015.0514 and is fixed in 2015.0514.

Back to Feed View Plugin Hub Open CVE Reference

Published

May 19, 2015

Last Updated

Jan 22, 2024

Slug

feedwordpress

Risk Profile

9.8 CVSS Score

Weakness

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Researchers

Adrián M. F.

Operational Summary

What the operator needs to know

Share Email

Patch Status

Patched release is available

Remediation

Update to version 2015.0514, or a newer patched version

Operator Briefing

CVE-2015-4018 is tracked for the Plugin FeedWordPress as critical severity with CVSS 9.8. The affected range is Versions before 2015.0514. Update FeedWordPress to 2015.0514 or newer where that version is compatible with the site.

Issue Type

SQL Injection

Primary Fixed Version

2015.0514

Primary Affected Range

Versions before 2015.0514

Tracking ID

CVE-2015-4018

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/da95086a-6ae2-4b4d-8312-78e3800ded7f?source=api-prod

Detailed Metadata

Software Type	Plugin
Software Slug	feedwordpress View on wordpress.org
CVE	CVE-2015-4018
Patched Versions	2015.0514
Affected Versions	Versions before 2015.0514

Related CVE Cluster

Related CVEs for FeedWordPress

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Medium CVE-2021-25055 2022.0123 Jan 18, 2022

CVE-2021-25055 FeedWordPress Cross-Site Scripting

FeedWordPress <= 2021.0713 - Reflected Cross-Site Scripting

Medium CVE-2015-9358 2015.0514 May 14, 2015

CVE-2015-9358 FeedWordPress Cross-Site Scripting

FeedWordPress < 2015.0514 - Reflected Cross-Site Scripting

Medium CVE-2024-0839 2024.0428 Mar 04, 2024

CVE-2024-0839 FeedWordPress Authorization Bypass

FeedWordPress <= 2022.0222 - Insecure Direct Object Referece

Medium 2015.0426 Apr 26, 2015

FeedWordPress Cross-Site Scripting

FeedWordPress < 2015.0426 - Cross-Site Scripting

Licensing Notices

This record contains material that is subject to copyright

DEFIANT

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more