REST API TO MiniProgram vulnerabilities

2 known vulnerabilities in REST API TO MiniProgram from Xjb. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  REST API TO MiniProgram: Authorization Bypass Through User-Controlled Key

  CVE-2024-8485Sep 25, 2024Xjb

  The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what u

• 7.5 High severity

  REST API TO MiniProgram: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-8484Sep 25, 2024XjbEPSS 3.76%

  The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the us