Arbitrary Shortcode Execution Vulnerability in WooCommerce Tables

CVE-2024-10959

Summary

The Active Products Tables plugin for WooCommerce presents a security vulnerability that permits arbitrary shortcode execution through the woot_get_smth AJAX action. This issue arises from inadequate validation of user input prior to executing do_shortcode commands. Consequently, unauthenticated attackers can exploit this flaw in all versions up to and including 1.0.6.5, potentially leading to unauthorized execution of shortcodes, which could compromise the integrity and security of affected WordPress sites. Website administrators are strongly encouraged to update their installations immediately to mitigate any risks associated with this vulnerability.

References