WordPress Product Filter by WBW Plugin SQL Injection Vulnerability Advisory (CVSS 9.7)

Vulnerability Overview Vulnerability Name: High-Priority SQL Injection Vulnerability in WordPress Product Filter by WBW Plugin <= 3.4.6 Vulnerability Type: SQL Injection Affected Versions: <= 3.4.6 CVSS Score: 9.7 (Critical) Publication Date: October 16, 2024 Vulnerability Description: This vulnerability allows attackers to execute arbitrary SQL queries without authorization, potentially leading to data leakage, data tampering, or complete server compromise. Scope of Impact Affected Plugin: WordPress Product Filter by WBW Plugin Affected Versions: Version 3.4.6 and earlier Affected Features: Search and filtering functionality within the plugin Remediation 1. Update the Plugin Immediately: Upgrade the plugin to the latest version (3.4.7 or higher). 2. Temporary Mitigation: If an immediate update is not possible, disable the plugin or restrict its access permissions. 3. Monitoring and Auditing: Regularly check for plugin updates and monitor website logs to detect potential attack activities. POC Code or Exploit Code No specific POC code or exploit code is provided in the document. Timeline Vulnerability Discovery: October 16, 2024 Vulnerability Disclosure: October 16, 2024 Patch Release: October 16, 2024 Additional Information Vulnerability Reporter: Patchstack Vulnerability Status: Fixed Vulnerability Impact: High Vulnerability Risk: Critical Summary The WordPress Product Filter by WBW Plugin version 3.4.6 and earlier contains a high-priority SQL injection vulnerability with a wide impact scope, which may lead to severe security issues. Users are strongly advised to immediately update the plugin to the latest version and implement appropriate mitigation measures to ensure website security.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Product Filter by WBW Plugin SQL Injection Vulnerability Advisory (CVSS 9.7)

More from this source