
Cloud Vulnerability DB
A community-led vulnerabilities database
The Ajax Load More WordPress plugin, versions before 5.3.2, contained a SQL Injection vulnerability (CVE-2021-24140) discovered in the POST /wp-admin/admin-ajax.php endpoint. The vulnerability was identified on May 18, 2020, and was fixed in version 5.3.2. This security issue affects the plugin's handling of the repeater parameter (WPScan).
The vulnerability is classified as a SQL Injection (SQLI) that occurs when processing unvalidated input in the repeater parameter. The exploit can be triggered using the payload 'repeater=' or sleep(5)#&type=test' in a POST request to /wp-admin/admin-ajax.php. The vulnerability has been assigned a CVSS score of 9.0 (critical) and is categorized under CWE-89 (SQL Injection). The issue falls under the OWASP Top 10 category A1: Injection (WPScan).
If successfully exploited, this vulnerability could allow an authenticated attacker to perform SQL injection attacks against the affected WordPress installation, potentially leading to unauthorized access to or modification of the database content (WPScan).
The vulnerability requires authentication with edit_theme_options capability, which is typically restricted to administrator accounts by default. Proof of concept exploits have been documented and are publicly available (WPScan).
Users should upgrade to Ajax Load More version 5.3.2 or later to address this vulnerability. The fix was implemented in the WordPress plugin repository through changeset 2308007 (WPScan).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."