title: SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
description: The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
problem types: CWE-89 SQL Injection
affected:
{
product: SpeakOut! Email Petitions
vendor: Unknown
versions:
lessThan: 2.14.15.1, status: affected, version: 2.14.15.1, versionType: custom
}