Hi,<\/p>\n
I think I found SQL injection in custom-maintenance-mode via POST request to cmmemail argument in ajax_subscriber.php:
\n`
\n 19\t\t$wpuser_result = $wpdb->get_results(“SELECT * FROM “.$table_name.” WHERE cmm_email='”.$_GET[‘cmmemail’].”‘”);
\n 20
\n 21\t\tforeach ( $wpuser_result as $userdetails ) {
\n 22\t\t$cmm_email = $userdetails->cmm_email;
\n 23\t\t}
\n 24\t\tif($cmm_email!=””)
\n 25\t\t{
\n 26\t\t\techo $msg = “Aleardy”;
\n 27\t\t}
\n 28\t\telse
\n 29\t\t{ $wpdb->insert( $table_name, array( ‘cmm_email’ => $_GET[‘cmmemail’], ‘cmm_date’ => date(‘Y:m:d H:i:s’)) );
\n 30\t\t\techo $msg = “Success”;
\n 31\t\t}
\n‘<\/p>\n
https:\/\/wordpress.org\/plugins\/custom-maintenance-mode\/<\/p>\n","protected":false},"template":"","class_list":["post-6593219","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6593219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6593219\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=6593219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}