CVE-2024-10899: WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting
First published: Wed Nov 20 2024(Updated: )
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Reflected Cross-Site Scripting as well.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WC Product Table Lite | <3.8.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b010ff-8a4a-4553-bb2b-d58a254d7ee4?source=cve
- https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/3.8.6/main.php#L1778
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190789%40wc-product-table-lite&new=3190789%40wc-product-table-lite&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-10899?
CVE-2024-10899 has been classified as a high-severity vulnerability due to the potential for arbitrary shortcode execution.
How do I fix CVE-2024-10899?
To mitigate CVE-2024-10899, update the WooCommerce Product Table Lite plugin to version 3.8.7 or later.
What versions of WooCommerce Product Table Lite are affected by CVE-2024-10899?
CVE-2024-10899 affects all versions of WooCommerce Product Table Lite up to and including 3.8.6.
What is the impact of CVE-2024-10899 on my WordPress site?
CVE-2024-10899 allows unauthorized users to execute arbitrary shortcodes, potentially compromising site security and functionality.
Is there a workaround for CVE-2024-10899 if I cannot update immediately?
A potential workaround for CVE-2024-10899 is to restrict user permissions to execute shortcodes until an update can be applied.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wcproducttable
- canonical/wc product table lite