SQL Injection vulnerability in TI WooCommerce Wishlist
CVE-2024-43917
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 August 2024
Badges
What is CVE-2024-43917?
A vulnerability exists in the TI WooCommerce Wishlist plugin developed by TemplateInvaders, which allows for SQL Injection attacks. This vulnerability can lead to unauthorized access to the underlying database, potentially compromising sensitive user data. Attackers can exploit this issue by injecting malicious SQL statements through unsanitized input fields within the plugin, enabling them to manipulate database queries. It is crucial for users running versions up to 2.8.2 of the TI WooCommerce Wishlist plugin to review and apply necessary security measures to mitigate the risks associated with this vulnerability.
Affected Version(s)
TI WooCommerce Wishlist <= 2.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
82% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved