CVE-2023-52133

The vulnerability stems from improper input validation and sanitization of user-supplied data within the 'Most And Least Read Posts Widget' plugin. Specifically, the plugin fails to properly neutralize special characters used in SQL queries, allowing an attacker to inject malicious SQL code. The root cause is likely a missing or inadequate implementation of parameterized queries or prepared statements when constructing SQL queries based on user input. This allows an attacker to manipulate the query's logic, leading to unauthorized access and control over the database. The absence of proper input validation, such as whitelisting or blacklisting of characters, further exacerbates the issue. The vulnerability exists due to the plugin's failure to properly escape or sanitize user-supplied data before incorporating it into SQL queries. This lack of proper input validation allows for the injection of malicious SQL code.