漏洞概述 漏洞名称: Product Catalog 8 1.2 Plugin WordPress SQL Injection CVE编号: CVE-2016-20065 CWE编号: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS评分: 8.8 CVSS向量: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N 发布日期: 6/9/2026 严重程度: HIGH 描述: Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables. 影响范围 受影响产品: Product Catalog 8 <= 1.2.0 修复方案 修复方案: 无具体修复方案提供，建议更新到最新版本或采取其他安全措施。 参考链接 ExploitDB-40783 Official Product Homepage Official Product Homepage 贡献者 贡献者: Lenon Leite