CVE-2024-43917
Published: 29 August 2024
Summary
CVE-2024-43917 is a critical-severity SQL Injection (CWE-89) vulnerability in Templateinvaders Ti Woocommerce Wishlist. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an SQL injection issue arising from improper neutralization of special elements in SQL commands, tracked as CWE-89, in the TI WooCommerce Wishlist WordPress plugin. It affects all versions from an unspecified starting point through 2.8.2 and carries a CVSS 3.1 score of 9.3 reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope.
Remote unauthenticated attackers can send crafted requests to the affected plugin to execute arbitrary SQL queries, enabling extraction of sensitive information with high confidentiality impact along with limited availability consequences that may extend beyond the immediate component.
The vulnerability is catalogued in the Patchstack database with a dedicated entry for the TI WooCommerce Wishlist plugin.
EPSS currently stands at 0.8970 with a recorded peak of 0.9003, indicating sustained high exploitation likelihood.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40567
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.