CVE-2024-2879
Published: 03 April 2024
Summary
CVE-2024-2879 is a critical-severity SQL Injection (CWE-89) vulnerability in Kreaturamedia Layerslider. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The LayerSlider plugin for WordPress is affected by CVE-2024-2879, a SQL injection vulnerability present in versions 7.9.11 and 7.10.0. The flaw exists in the ls_get_popup_markup action and stems from insufficient escaping of user-supplied parameters combined with inadequate preparation of the existing SQL query, corresponding to CWE-89 and carrying a CVSS v3.1 score of 9.8.
Unauthenticated attackers can exploit the issue over the network to append additional SQL queries, allowing them to extract sensitive information from the database.
The referenced vendor release log and Wordfence threat intelligence entries address the vulnerability and point to available updates that resolve the injection vector.
The associated EPSS score stands at a current value of 0.9367 with a recorded peak of 0.9379.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27823
Vulnerability details
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
more
it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.