title: Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection
description: The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
problem types: CWE-89 SQL Injection
affected:
{
vendor: Unknown
product: Track The Click
versions:
status: affected, versionType: custom, version: 0, lessThan: 0.3.12
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}