CVE-2024-6365 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Remote Code Execution (RCE) in 'Product Table by WBW'. 💥 **Consequences**: Attackers can execute arbitrary code on the server. Total compromise of the WordPress site is possible.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-94 (Code Injection). ⚠️ **Flaw**: The plugin fails to properly sanitize or validate user-supplied input before processing it, allowing malicious code injection.

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: Product Table for WooCommerce by WBW. 📅 **Versions**: Version 2.0.1 and all earlier versions. 🏢 **Vendor**: woobewoo.

Q: What can hackers do? (Privileges/Data)

🔓 **Privileges**: Full system access (High CVSS). 📊 **Data Impact**: - **Confidentiality**: High (Full data leak). - **Integrity**: High (Data tampering). - **Availability**: High (Service disruption).

Q: Is exploitation threshold high? (Auth/Config)

🌐 **Threshold**: LOW. 🔑 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 📡 **Access**: Network (AV:N). ✅ **Complexity**: Low (AC:L). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: No specific PoC provided in the data (pocs: []). 🌍 **Wild Exploitation**: Likely high due to low complexity and network accessibility. Wordfence has issued a threat intel alert.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check WordPress plugins list for 'Product Table by WBW'. 2. Verify version is ≤ 2.0.1. 3. Scan for the file `customTitle.php` or `wootablepress.php` in the plugin directory.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: YES. 📝 **Patch**: Changeset 3113335 on WordPress Trac indicates a fix was released. 🔗 **Ref**: https://plugins.trac.wordpress.org/changeset/3113335/

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable/Deactivate** the plugin immediately. 2. **Remove** the plugin if not needed. 3. Monitor server logs for suspicious PHP execution attempts.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. ⚡ **Priority**: Patch IMMEDIATELY. 📉 **Risk**: CVSS 9.8 (Critical). Unauthenticated RCE is a top-tier threat. Do not delay.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Remote Code Execution (RCE) in 'Product Table by WBW'.
💥 **Consequences**: Attackers can execute arbitrary code on the server. Total compromise of the WordPress site is possible.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-94 (Code Injection).
⚠️ **Flaw**: The plugin fails to properly sanitize or validate user-supplied input before processing it, allowing malicious code injection.

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: Product Table for WooCommerce by WBW.
📅 **Versions**: Version 2.0.1 and all earlier versions.
🏢 **Vendor**: woobewoo.

Q4What can hackers do? (Privileges/Data)

🔓 **Privileges**: Full system access (High CVSS).
📊 **Data Impact**: 
- **Confidentiality**: High (Full data leak).
- **Integrity**: High (Data tampering).
- **Availability**: High (Service disruption).

Q5Is exploitation threshold high? (Auth/Config)

🌐 **Threshold**: LOW.
🔑 **Auth**: None required (PR:N).
🖱️ **UI**: None required (UI:N).
📡 **Access**: Network (AV:N).
✅ **Complexity**: Low (AC:L). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: No specific PoC provided in the data (pocs: []).
🌍 **Wild Exploitation**: Likely high due to low complexity and network accessibility. Wordfence has issued a threat intel alert.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 
Check WordPress plugins list for 'Product Table by WBW'.
Verify version is ≤ 2.0.1.
Scan for the file `customTitle.php` or `wootablepress.php` in the plugin directory.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: YES.
📝 **Patch**: Changeset 3113335 on WordPress Trac indicates a fix was released.
🔗 **Ref**: https://plugins.trac.wordpress.org/changeset/3113335/

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 
**Disable/Deactivate** the plugin immediately.
**Remove** the plugin if not needed.
Monitor server logs for suspicious PHP execution attempts.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL.
⚡ **Priority**: Patch IMMEDIATELY.
📉 **Risk**: CVSS 9.8 (Critical). Unauthenticated RCE is a top-tier threat. Do not delay.

Continue exploring

Vulnerability detail Full AI analysis (login) woobewoo CWE-94