CVE-2024-38788

WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerability

View on CVE.org

Published Jul 22, 2024 CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Bởi Admin 2020

UiPress lite

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 3.4.06

Configuration 1 [-]

cpe:2.3:a:uipress:uipress_lite:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

Vendor Solution

Update to 3.4.07 or a higher version.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-37626	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.612% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve

History

Apr 29, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Uipress Uipress Lite

Weaknesses

CWE-89

Sources

CVE record Updated: Apr 28, 2026, 4:10 PM

Status: PUBLISHED
Assigner: Patchstack
Published: Jul 22, 2024, 10:06 AM
Updated: Apr 28, 2026, 4:10 PM
Reserved: Jun 19, 2024, 3:07 PM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 4:19 AM

Updated: Aug 2, 2024, 4:19 AM

NVD Updated: Jun 17, 2026, 7:41 AM

Status: Modified
Published: Jul 22, 2024, 11:15 AM
Modified: Jun 17, 2026, 7:41 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38788", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-06-19T15:07:57.035Z", "datePublished": "2024-07-22T10:06:00.992Z", "dateUpdated": "2026-04-28T16:10:06.944Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "uipress-lite", "product": "UiPress lite", "vendor": "B\u1edfi Admin 2020", "versions": [{"changes": [{"at": "3.4.07", "status": "unaffected"}], "lessThanOrEqual": "3.4.06", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nguy\u1ec5n Trung Ki\u00ean - anhchangmutrang (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in B\u1edfi Admin 2020 UiPress lite allows SQL Injection.<p>This issue affects UiPress lite: from n/a through 3.4.06.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in B\u1edfi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:10:06.944Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 3.4.07 or a higher version."}], "value": "Update to 3.4.07 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T13:27:36.577890Z", "id": "CVE-2024-38788", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T13:27:42.989Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.557Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.557Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-22T13:27:36.577890Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T13:27:40.299Z"}}], "cna": {"title": "WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nguy\u1ec5n Trung Ki\u00ean - anhchangmutrang (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "B\u1edfi Admin 2020", "product": "UiPress lite", "versions": [{"status": "affected", "changes": [{"at": "3.4.07", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.4.06"}], "packageName": "uipress-lite", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 3.4.07 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 3.4.07 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in B\u1edfi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in B\u1edfi Admin 2020 UiPress lite allows SQL Injection.<p>This issue affects UiPress lite: from n/a through 3.4.06.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:10:06.944Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38788", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:10:06.944Z", "dateReserved": "2024-06-19T15:07:57.035Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-07-22T10:06:00.992Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "uipress-lite", "product": "UiPress lite", "vendor": "B\u1edfi Admin 2020", "versions": [{"changes": [{"at": "3.4.07", "status": "unaffected"}], "lessThanOrEqual": "3.4.06", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uipress:uipress_lite:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "4BE31166-7CE8-494E-8A0E-DE04C96E4F4E", "versionEndExcluding": "3.4.07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in B\u1edfi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales usados en de comando SQL (\"Inyecci\u00f3n SQL\") en B?i Admin 2020 UiPress lite permite la inyecci\u00f3n SQL. Este problema afecta a UiPress lite: desde n/a hasta 3.4.06."}], "id": "CVE-2024-38788", "lastModified": "2026-06-17T07:41:03.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38788", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-22T13:27:36.577890Z", "version": "2.0.3"}}]}, "published": "2024-07-22T11:15:04.953", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "audit@patchstack.com", "type": "Secondary"}]}