CVE-2023-6967

The Pods – Custom Content Types and Fields plugin contains a SQL injection vulnerability in its shortcode functionality affecting versions up to 3.0.10, excluding patched releases 2.7.31.2, 2.8.23.2, and 2.9.19.2. Inadequate escaping of user-supplied parameters combined with insufficient query preparation allows authenticated users with contributor-level permissions or greater to inject malicious SQL code into existing database queries. This vulnerability enables attackers to execute unauthorized queries that could expose sensitive database information.

Based on public CVE data (MITRE/NVD).