CVE-2020-11530: Chop Slider 3 WordPress plugin blind SQL injection via id parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and a very high EPSS probability make this an urgent exposure for any site running the plugin.

What it is

Chop Slider 3, a WordPress plugin, contains a blind SQL injection in the id GET parameter passed to get_script/index.php. Because the query runs as the WordPress database user, an unauthenticated attacker can read or alter site data. The flaw is trivially reachable over the network with no credentials or user interaction.

Impact

An attacker can execute arbitrary SQL in the context of the WordPress database user, exposing or modifying stored data such as user credentials and site content. Depending on database privileges, this can lead to full site compromise.

Attack surface

Reached remotely over HTTP by sending a crafted id parameter to get_script/index.php. The CVSS vector shows no privileges required and no user interaction, so it is exploitable by any network attacker.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.95657, 99.868th percentile) and multiple references are tagged Exploit, indicating public exploit code exists. No ransomware usage is documented.

What to do

• Update or remove the Chop Slider 3 plugin; check the vendor repository for a fixed release since no patched version is stated in the record.
• If no fix is available, deactivate and uninstall the plugin.
• Deploy a WAF rule blocking SQL injection patterns on get_script/index.php and the id parameter.
• Restrict database user privileges for the WordPress account to least privilege.
• Audit the site for indicators of compromise and rotate WordPress database and admin credentials if tampering is suspected.

Detection

• Monitor web logs for requests to get_script/index.php with suspicious id parameter values, including SQL keywords, quotes, or boolean/time-based payloads.
• Alert on SQL error strings or unusual query latency in database and application logs tied to that endpoint.
• Review database audit logs for unexpected SELECT, UNION, or stacked queries from the WordPress user.
• Hunt for outbound or anomalous database activity following requests to the plugin path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.