WordPress Get a Quote Plugin Unauthenticated Arbitrary Shortcode Execution (CVE-2024-11034)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - Request a Quote for WooCommerce and Elementor - Get a Quote Button - Product Enquiry Form Popup - Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form 2. Vulnerability Type: - Improper Control of Generation of Code (Code Injection) 3. CVSS Score: - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 4. CVE ID: - CVE-2024-11034 5. CVSS Score (High): - 7.3 6. Public Release Date: - November 22, 2024 7. Last Updated Date: - November 23, 2024 8. Researcher: - Arkadiusz Hydzik 9. Affected Versions: - <= 1.4 10. Patched: - Yes 11. Remediation Advice: - Update to version 1.5, or a newer patched version 12. Reference Links: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org 13. Vulnerability Description: - The Request a Quote for WooCommerce and Elementor - Get a Quote Button - Product Enquiry Form Popup - Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all versions up to, and including, 1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. 14. Vulnerability Details: - Software Type: Plugin - Software Slug: get-a-quote-button-for-woocommerce - Patched?: Yes - Remediation: Update to version 1.5, or a newer patched version - Affected Version: <= 1.4 - Patched Version: 1.5 15. Copyright and Licensing Information: - Copyright 2012-2024 Defiant Inc. - Copyright 1999-2024 The MITRE Corporation 16. Contact Information: - wfi-support@wordfence.com This information helps users understand the vulnerability in detail, including its scope of impact, remediation steps, and how to obtain further information.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Get a Quote Plugin Unauthenticated Arbitrary Shortcode Execution (CVE-2024-11034)

More from this source