CVE-2024-6924
Published: 08 September 2024
Summary
CVE-2024-6924 is a critical-severity SQL Injection (CWE-89) vulnerability in Themetechmount Truebooker. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a SQL injection flaw, tracked as CVE-2024-6924, that affects the TrueBooker WordPress plugin prior to version 1.0.3. The root cause is insufficient sanitization and escaping of a parameter supplied to an AJAX action, which is then used directly in a SQL statement, corresponding to CWE-89. The issue carries a CVSS 3.1 score of 9.8.
Unauthenticated attackers can invoke the exposed AJAX endpoint over the network to inject arbitrary SQL, enabling them to read, modify, or delete database contents and potentially achieve full control over the affected WordPress site.
The WPScan advisory recommends updating the TrueBooker plugin to version 1.0.3 or later to close the injection vector. The EPSS score has reached 0.7651 without a documented low-to-high trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47910
Vulnerability details
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.