via pluginvulnerabilities.com => original post link
In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.
Admin+ SQL Injection in POST SMTP
WPScan is claiming that the WordPress plugin POST SMTP had contained an admin+ SQL injection vulnerability. Presumably, they are claiming the attacker would need to be logged in as an Administrator, but that isn’t clear from their description that says “exploitable by high privilege users such as admin.” If it were only accessible by Administrators, that wouldn’t be a vulnerability unless there was also an issue with cross-site request forgery (CSRF). [Read more]