CVE-2023-5466: 
WordPress vulnerability analysis and mitigation

The Wp anything slider plugin for WordPress (CVE-2023-5466) contains a SQL Injection vulnerability discovered in versions up to and including 9.1. The vulnerability was publicly disclosed on October 30, 2023, and was identified by researcher István Márton from Wordfence (Wordfence Advisory).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries in the plugin's shortcode functionality. The issue has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD Database).

When exploited, this vulnerability allows authenticated attackers with subscriber-level permissions or higher to append additional SQL queries to existing queries. This capability can be leveraged to extract sensitive information from the WordPress database (NVD Database).

Patches for this vulnerability have been released and are available in the WordPress plugin repository. Users are advised to update their Wp anything slider plugin to the latest version beyond 9.1 (WordPress Patch).