SQL Injection Vulnerability in Wallet for WooCommerce Plugin

CVE-2024-6353

What is CVE-2024-6353?

The Wallet for WooCommerce plugin for WordPress has a SQL Injection vulnerability due to improper handling of the 'search[value]' parameter in all versions up to and including 1.5.4. This flaw stems from insufficient escaping of user-supplied inputs and a lack of adequate preparation within the SQL query. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability. Once exploited, they can inject additional SQL queries into existing ones, potentially allowing them to access and extract sensitive information stored in the database.

References