CVE-2019-25746
WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 15, 2026
- Updated
- Jul 15, 2026
- Reserved
- Jun 15, 2026
Description
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Sliced InvoicesSlicedInvoices |
|
References
- ExploitDB-47540exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.