### [CVE-2021-24769](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24769)
![](https://img.shields.io/static/v1?label=Product&message=Permalink%20Manager%20Lite&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.2.13.1%3C%202.2.13.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection

### POC

#### Reference
- https://wpscan.com/vulnerability/a2f211af-5373-425f-9964-ebbf5efde87b

#### Github
No PoCs found on GitHub currently.