CVE-2023-1471: 
WordPress vulnerability analysis and mitigation

The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5. The vulnerability was discovered and disclosed on March 17, 2023 (NVD).

The vulnerability exists in the WP Popup Banners plugin where the 'banner_id' parameter is not properly sanitized before being used in SQL queries. This occurs specifically in the plugin's preview functionality where the banner_id parameter from GET requests is directly concatenated into SQL queries without proper sanitization or preparation (WordPress Plugin).

An attacker could potentially exploit this vulnerability to manipulate SQL queries, potentially leading to unauthorized access to the database, data theft, or manipulation of database contents.

The vulnerability can be exploited through the plugin's preview functionality, which is accessible to authenticated users. The attack vector requires the ability to manipulate the 'banner_id' parameter in GET requests to the affected WordPress installation.

Users should update to a version newer than 1.2.5 of the WP Popup Banners plugin. If immediate updating is not possible, consider disabling the plugin until an update can be applied.