CVE-2024-6926
Published: 04 September 2024
Summary
CVE-2024-6926 is a critical-severity SQL Injection (CWE-89) vulnerability in Wow-Company Viral Signup. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Viral Signup WordPress plugin through version 2.1 contains a SQL injection vulnerability (CWE-89) because it does not properly sanitize and escape a parameter before incorporating it into a SQL statement. The flaw is exposed through an AJAX action that does not require authentication, and the issue carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can therefore supply crafted input to the affected AJAX endpoint and execute arbitrary SQL queries against the database. Successful exploitation can result in disclosure, modification, or deletion of data, and in many WordPress deployments may also permit privilege escalation or full site takeover.
The single referenced advisory at WPScan provides the technical details of the injection vector but does not describe available patches or configuration workarounds. The associated EPSS score has reached 0.7445 without an observable climb from a lower baseline after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47912
Vulnerability details
The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.