CVE-2024-37112
WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('inyección SQL') en Membership Software WishList Member X. Este problema afecta a WishList Member X: desde n/a antes de 3.26.7.
The WishList Member X plugin for WordPress is vulnerable SQL Injection in versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to run arbitrary SQL queries that can be used to extract sensitive information from the database and inject new information.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-06-03 CVE Reserved
- 2024-06-20 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (1)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wishlist Member X Search vendor "Wishlist Member X" | Wishlist Member X Search vendor "Wishlist Member X" for product "Wishlist Member X" | >= 0.0.0 <= 3.25.1 Search vendor "Wishlist Member X" for product "Wishlist Member X" and version " >= 0.0.0 <= 3.25.1" | en |
Affected
|