WordPress SalesKing प्लगइन <= 1.6.15 - अनाधिकृत विशेषाधिकार वृद्धि (Privilege Escalation) भेद्यता

Successful exploitation of CVE-2024-22157 allows an attacker to escalate their privileges within the SalesKing WordPress plugin. This could lead to complete control over the WordPress site, including the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and even compromise the underlying server. The impact is particularly severe because SalesKing is often used for managing customer relationships and sales processes, making the data at risk highly valuable. A compromised SalesKing instance could be used as a launching point for further attacks against the entire network, demonstrating a significant blast radius.

Organizations using SalesKing for customer relationship management or sales tracking are at significant risk. Specifically, those running older versions of SalesKing (≤1.6.15) and those with limited security monitoring or patching practices are particularly vulnerable. Shared WordPress hosting environments are also at increased risk, as a compromised SalesKing plugin on one site could potentially impact other sites on the same server.

• wordpress / composer / npm:

wp plugin list --status=inactive | grep SalesKing

• wordpress / composer / npm:

wp plugin update --all

• wordpress / composer / npm:

wp plugin status SalesKing

• wordpress / composer / npm:

grep -r 'SalesKing' /var/www/html/wp-content/plugins/

1. 2024-05-17Disclosure

   disclosure

1. आरक्षित2024-01-05
2. प्रकाशित2024-05-17
3. संशोधित2024-08-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-22157 is to immediately upgrade SalesKing to version 1.6.16 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These might include restricting access to SalesKing administrative functions based on user roles and implementing strict input validation to prevent malicious code injection. While a WAF might offer some protection, it is not a substitute for patching. After upgrading, verify the fix by attempting to access administrative functions with a non-administrative user account and confirming that access is denied.