SQL Injection Vulnerability in WooCommerce Products Filter Plugin

CVE-2024-1795

What is CVE-2024-1795?

The HUSKY Products Filter for WooCommerce Professional plugin for WordPress contains a vulnerability that allows SQL Injection through the 'name' parameter in the woof shortcode. This issue arises from insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. As a result, an authenticated attacker with contributor-level access or higher can insert additional SQL queries into existing ones. This could potentially enable the attacker to retrieve sensitive information from the database, posing a significant risk to data privacy and integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References