CVE-2024-9156: TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parameters
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9156?
CVE-2024-9156 has a severity rating that indicates it poses a risk due to SQL Injection vulnerabilities.
How do I fix CVE-2024-9156?
You can fix CVE-2024-9156 by upgrading the TI WooCommerce Wishlist plugin to version 2.8.3 or later.
Who is affected by CVE-2024-9156?
CVE-2024-9156 affects users of the TI WooCommerce Wishlist plugin versions up to and including 2.8.2.
Can CVE-2024-9156 be exploited by unauthenticated users?
Yes, CVE-2024-9156 can be exploited by unauthenticated attackers due to insufficient validation.
What kind of attack can be performed using CVE-2024-9156?
CVE-2024-9156 can lead to SQL Injection attacks, allowing attackers to manipulate the database.