The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hide_my_wp | Wpwave | * | 6.2.9 (excluding) |