CVE:CVE-2009-4748
CNNVD:CNNVD-201003-407
WordPress是一款免费的论坛Blog系统。
WordPress的My Category Order插件的脚本mycategoryorder.php存在SQL注入漏洞。远程攻击者可以借助脚本wp-admin/post-new.php中的act_OrderCategories功能的parentID参数，执行任意的SQL命令。
solution:Upgrade andrew_charlton my_category_order to a higher version than 2.8,2.6.1,2.6.1a,2.7,2.7.1,and avoid the version (,2.8],2.6.1,2.6.1a,2.7,2.7.1