Spiffy Calendar SQL Injection Lets Hackers Hijack WordPress Databases
A straightforward SQL injection in Spiffy Calendar plugin opens doors for database dumps and site takeovers. Thousands of WordPress installs could be vulnerable—time to check yours.
⚡ Key Takeaways
- CVE-2022-46859 enables unauthenticated SQL injection in Spiffy Calendar up to v4.9.1, risking full database compromise. 𝕏
- WordPress plugin ecosystem's lax auditing fuels repeat vulns like this; patch immediately or switch plugins. 𝕏
- Thousands of sites may still be exposed—audit now, as botnets target WP SQLi aggressively. 𝕏
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by NVD Vulnerabilities
Related Stories
Vulnerabilities & CVEs
CVE-2022-46808: The SQL Injection Lurking in ARMember's Membership Plugin
Vulnerabilities & CVEs
Slimstat's SQL Injection Nightmare: CVE-2022-45373 Cracks Open Analytics Doors
Vulnerabilities & CVEs
CVE-2022-47428: The SQL Injection Lurking in Your WordPress Booking Calendar
Vulnerabilities & CVEs