Wp Championship Vulnerabilities

[en] The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Sto...

Affected:

up to 9.3

Fixed in:

9.3

Disclosed:

Jul 4, 2022

CVE-2022-1967 on NVD →

The wp-championship plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.2. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform a wide range of administrative tasks via a forged request...

CVSS:

8.8

Affected:

up to 9.2

Fixed in:

9.3

Disclosed:

Jun 7, 2022

CVE-2022-1967 on NVD →

[en] Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Nov 2, 2015

CVE-2015-5308 on NVD →

Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.

CVSS:

8.8

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Oct 23, 2015

CVE-2015-5308 on NVD →