CVE-2020-15363: 
WordPress vulnerability analysis and mitigation

The CVE-2020-15363 is a SQL injection vulnerability discovered in the Nexos Real Estate WordPress Theme version 1.7 and earlier. The vulnerability was discovered on June 17th, 2020, and was fixed with the release of version 1.8 on June 19th, 2020. The vulnerability affects the side-map functionality of the theme, specifically through the search_order parameter (WPScan).

The vulnerability exists in the side-map functionality of the Nexos Real Estate WordPress Theme, where the search_order parameter is not properly sanitized, allowing for SQL injection attacks. The vulnerability can be exploited through the URL path '/side-map/?search_order=' without requiring authentication (WPScan).

If successfully exploited, the vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially enabling them to access and manipulate the database, including sensitive information such as user credentials and other confidential data stored in the WordPress database (WPScan).

The vulnerability is easily exploitable by unauthenticated users through the manipulation of the search_order parameter in the side-map functionality. Proof of concept exploits have demonstrated successful database enumeration using tools like sqlmap (WPScan).

The vulnerability was patched in version 1.8 of the Nexos Real Estate WordPress Theme. Users are strongly advised to upgrade to version 1.8 or later to mitigate this security risk (WPScan, Trustwave).