CVE-2024-7854 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unauthenticated SQL Injection in 'Woo Inquiry' plugin. 💥 **Consequences**: Attackers can append malicious SQL queries to extract sensitive database information. Critical integrity and confidentiality loss.

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🔍 **Flaw**: Insufficient escaping on the user-supplied parameter `dbid` and lack of prepared statements in existing SQL queries.

Q: Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin 'Woo Inquiry' (Ultimate Store Kit). 👤 **Vendor**: sjhoo. 📉 **Affected**: Versions 0.1 and earlier.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🚪 **Auth**: None required (Unauthenticated). ⚙️ **Config**: No special configuration needed. 🎯 **Ease**: Low complexity (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

✅ **Yes**. 📜 **PoC**: Available on GitHub (RandomRobbieBF/CVE-2024-7854). 🤖 **Scanner**: Nuclei templates available (projectdiscovery/nuclei-templates). 🌍 **Wild Exploitation**: Potential due to public PoC.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for 'Woo Inquiry' plugin version <= 0.1. 🛠️ **Tool**: Use Nuclei with CVE-2024-7854 template. 🔎 **Target**: Look for unescaped `dbid` parameter in SQL requests.

Q: Is it fixed officially? (Patch/Mitigation)

⚠️ **Status**: Data implies vulnerability exists in v0.1. 📝 **Reference**: WordFence and WP Trac links provided. 🔄 **Action**: Update plugin immediately if newer version exists, or remove if no patch available.

Q: What if no patch? (Workaround)

🚫 **Workaround**: Disable or uninstall the 'Woo Inquiry' plugin. 🛡️ **WAF**: Block SQL injection patterns targeting the `dbid` parameter. 🧹 **Audit**: Review database logs for suspicious queries.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL. 🚨 **Urgency**: HIGH. ⚡ **Reason**: Unauthenticated + SQL Injection + Public PoC = Immediate risk. Patch or mitigate NOW.

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unauthenticated SQL Injection in 'Woo Inquiry' plugin. 💥 **Consequences**: Attackers can append malicious SQL queries to extract sensitive database information. Critical integrity and confidentiality loss.

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🔍 **Flaw**: Insufficient escaping on the user-supplied parameter `dbid` and lack of prepared statements in existing SQL queries.

Q3Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin 'Woo Inquiry' (Ultimate Store Kit). 👤 **Vendor**: sjhoo. 📉 **Affected**: Versions 0.1 and earlier.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: Unauthenticated (No login needed). 📂 **Data**: Can extract sensitive information from the database.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🚪 **Auth**: None required (Unauthenticated). ⚙️ **Config**: No special configuration needed. 🎯 **Ease**: Low complexity (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

✅ **Yes**. 📜 **PoC**: Available on GitHub (RandomRobbieBF/CVE-2024-7854). 🤖 **Scanner**: Nuclei templates available (projectdiscovery/nuclei-templates). 🌍 **Wild Exploitation**: Potential due to public PoC.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for 'Woo Inquiry' plugin version <= 0.1. 🛠️ **Tool**: Use Nuclei with CVE-2024-7854 template. 🔎 **Target**: Look for unescaped `dbid` parameter in SQL requests.

Q8Is it fixed officially? (Patch/Mitigation)

⚠️ **Status**: Data implies vulnerability exists in v0.1. 📝 **Reference**: WordFence and WP Trac links provided. 🔄 **Action**: Update plugin immediately if newer version exists, or remove if no patch available.

Q9What if no patch? (Workaround)

🚫 **Workaround**: Disable or uninstall the 'Woo Inquiry' plugin. 🛡️ **WAF**: Block SQL injection patterns targeting the `dbid` parameter. 🧹 **Audit**: Review database logs for suspicious queries.

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL. 🚨 **Urgency**: HIGH. ⚡ **Reason**: Unauthenticated + SQL Injection + Public PoC = Immediate risk. Patch or mitigate NOW.

Continue exploring

Vulnerability detail Full AI analysis (login) sjhoo CWE-89