SQL injection vulnerability | ww.wp.xz.cn

Resolved darylnewswanger
(@darylnewswanger)

1 year ago

I’ve been informed by my site host (WP Engine) that version 2.26.1 of Relevanssi is vulnerable to a SQL injection attack. To quote, “The plugin contains a vulnerability wherein unauthenticated visitors could inject SQL statements into WordPress. A SQL injection could allow an attacker to gain control of your site.”

They referred to this page on Patchstack to support the concern: https://patchstack.com/database/wordpress/plugin/relevanssi-premium/vulnerability/wordpress-relevanssi-premium-plugin-2-27-4-unauthenticated-sql-injection

Is this true?

And if so, how can I update? Oddly in my WordPress dashboard, I don’t have the option to update the plug-in to a newer version. I am currently running 2.26.1, the same one mentioned above.

Viewing 5 replies - 1 through 5 (of 5 total)

Plugin Author Mikko Saari
(@msaari)

12 months ago

This forum is for the free version. The Premium support is at Relevanssi.com.

I can say that 2.26.1 has a bug with the updates. Either update manually or get a fix from the 2.27 release notes post on Relevanssi.com. The vulnerability is real.

For further discussion, use the Premium support.

Thread Starter darylnewswanger
(@darylnewswanger)

12 months ago

Thank you!

Thread Starter darylnewswanger
(@darylnewswanger)

12 months ago

Mikko, I have a Premium account and the plugin is active on my site. But when I log in to Relevanssi.com, it tells me my account has expired and there is no support form given, nor download option. Can you assist?

Plugin Author Mikko Saari
(@msaari)

12 months ago

Yes, but I’m not allowed to help you here. This forum is only for the free version support. See the contact information here. It’s possible your license has expired, in which case you need to buy a new license.

Thread Starter darylnewswanger
(@darylnewswanger)

12 months ago

We made a one-time purchase. I will send an email now because I’m not given any option to create a Premium support ticket.

Thanks,

Daryl

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘SQL injection vulnerability’ is closed to new replies.

6 replies
2 participants
Last reply from: darylnewswanger
Last activity: 12 months ago
Status: resolved