Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2024-10687 β€” AI Deep Analysis Summary

CVSS 9.8 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in Contest Gallery plugin. πŸ’₯ **Consequences**: Attackers can manipulate database queries via the `$collectedIds` parameter.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: CWE-89 (SQL Injection). πŸ› **Flaw**: Unsanitized user input in the `$collectedIds` parameter allows time-based SQL injection.…

Q3Who is affected? (Versions/Components)

πŸ‘₯ **Affected**: WordPress site owners using the **Contest Gallery** plugin. πŸ“¦ **Versions**: Version **24.0.3 and earlier**. If you are running 24.0.4 or later, you are likely safe.

Q4What can hackers do? (Privileges/Data)

πŸ•΅οΈ **Capabilities**: Hackers can execute arbitrary SQL commands.…

Q5Is exploitation threshold high? (Auth/Config)

⚑ **Threshold**: **LOW**. 🚫 **Auth**: No authentication required (PR:N). πŸ–±οΈ **UI**: No user interaction needed (UI:N). 🌐 **Network**: Remote exploitation possible (AV:N). This is a critical, easy-to-exploit flaw.

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ“œ **Exploit Status**: No public PoC/Exploit code listed in the data. πŸ” **However**: The vulnerability is well-documented by Wordfence.…

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: Scan your WordPress plugins. πŸ“‹ **Look For**: 'Contest Gallery' plugin. πŸ”’ **Verify Version**: Check if version is ≀ 24.0.3.…

Q8Is it fixed officially? (Patch/Mitigation)

βœ… **Fixed**: Yes. πŸ“₯ **Patch**: Update to version **24.0.4** or later. πŸ“ **Reference**: See the WordPress Trac changeset for the fix details. Immediate update is the primary mitigation.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: If you cannot update immediately, consider **deactivating** the Contest Gallery plugin.…

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: **CRITICAL**. πŸ“… **Priority**: Patch **IMMEDIATELY**. With CVSS 9.1 (High) and no auth required, this is a prime target for automated bots. Delay increases risk of compromise significantly.