title: ArtPlacer Widget < 2.20.7 - Editor+ SQLi
description: The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
problem types: CWE-89 SQL Injection
affected:
{
vendor: Unknown
product: ArtPlacer Widget
versions:
status: affected, versionType: semver, version: 0, lessThan: 2.20.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}