CVE-2021-24140: 
WordPress vulnerability analysis and mitigation

The Ajax Load More WordPress plugin, versions before 5.3.2, contained a SQL Injection vulnerability (CVE-2021-24140) discovered in the POST /wp-admin/admin-ajax.php endpoint. The vulnerability was identified on May 18, 2020, and was fixed in version 5.3.2. This security issue affects the plugin's handling of the repeater parameter (WPScan).

The vulnerability is classified as a SQL Injection (SQLI) that occurs when processing unvalidated input in the repeater parameter. The exploit can be triggered using the payload 'repeater=' or sleep(5)#&type=test' in a POST request to /wp-admin/admin-ajax.php. The vulnerability has been assigned a CVSS score of 9.0 (critical) and is categorized under CWE-89 (SQL Injection). The issue falls under the OWASP Top 10 category A1: Injection (WPScan).

If successfully exploited, this vulnerability could allow an authenticated attacker to perform SQL injection attacks against the affected WordPress installation, potentially leading to unauthorized access to or modification of the database content (WPScan).

The vulnerability requires authentication with edit_theme_options capability, which is typically restricted to administrator accounts by default. Proof of concept exploits have been documented and are publicly available (WPScan).

Users should upgrade to Ajax Load More version 5.3.2 or later to address this vulnerability. The fix was implemented in the WordPress plugin repository through changeset 2308007 (WPScan).