CVE-2023-5430: 
WordPress vulnerability analysis and mitigation

The Jquery news ticker plugin for WordPress contains a SQL Injection vulnerability (CVE-2023-5430) in versions up to and including 3.0. The vulnerability exists in the plugin's shortcode functionality due to insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Wordfence has assigned it a higher score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability stems from improper parameter handling in the plugin's shortcode implementation (NVD).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to append additional SQL queries to existing queries. This can be exploited to extract sensitive information from the database (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack vector is network-accessible and requires low attack complexity (NVD).

Users should upgrade to version 3.1 or later of the Jquery news ticker plugin, which contains fixes for this vulnerability (NVD).