SQL Injection Vulnerability in WooCommerce Products Filter Plugin

CVE-2024-1795

Summary

The HUSKY Products Filter for WooCommerce Professional plugin for WordPress contains a vulnerability that allows SQL Injection through the 'name' parameter in the woof shortcode. This issue arises from insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. As a result, an authenticated attacker with contributor-level access or higher can insert additional SQL queries into existing ones. This could potentially enable the attacker to retrieve sensitive information from the database, posing a significant risk to data privacy and integrity.

References