The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injec…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.01111·Published 2023-01-02·Fixed in 1.0.19