by Kastro
Paper/Archive/CVE-2021-24849

CVE-2021-24849

Unknown WCFM Marketplace – Best Multivendor Marketplace for WooCommerce — WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection

EPSS 8%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.0.950 × 2019.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections

Affected

ProductAffectedFixed inSource
WCFM Marketplace – Best Multivendor Marketplace for WooCommerce3.4.12 – < 3.4.123.4.12CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e