We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2019-25746

CVE-2019-25746

WordPress

Severity: HIGH
CVSS: 7.1CVSS
Published: 2026-06-15
Last modified: 2026-06-15
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE: CWE-89

Description

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

References

https://slicedinvoices.com/
https://wordpress.org/plugins/sliced-invoices/
https://www.exploit-db.com/exploits/47540
https://www.vulncheck.com/advisories/wordpress-sliced-invoices-sql-injection-via-post-parameter

Summary

Description

References