SQL Injection Vulnerability in NotFound ARPrice Plugin for WordPress
CVE-2024-49655

9.3CRITICAL

Key Information:

Vendor
WordPress
Status
Arprice
Vendor
CVE Published:
21 January 2025

Summary

The NotFound ARPrice plugin for WordPress has a vulnerability that allows for SQL Injection through improper neutralization of special elements in an SQL command. This flaw permits unauthorized users to manipulate SQL queries, potentially leading to unauthorized data access and database compromise. Affected versions range from n/a to 4.0.3. Website owners using this plugin should take immediate action to secure their systems.

Affected Version(s)

ARPrice <= 4.0.3

References

https://patchstack.com/database/wordpress/plugin/arprice/...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds (Patchstack Alliance)
.