CVE-2024-7854

Deeper analysis

The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 0.1. The flaw stems from insufficient escaping of the user-supplied 'dbid' parameter combined with a lack of prepared statements in the existing SQL query, as identified under CWE-89. The issue carries a CVSS 3.1 score of 10.0, reflecting network-accessible exploitation with no required authentication or user interaction and full impact across confidentiality, integrity, and availability with changed scope.

Unauthenticated attackers can exploit the vulnerability by supplying crafted input that appends additional SQL queries to existing statements, enabling extraction of sensitive database contents. The high EPSS score of 0.8034, which matches its recorded peak, indicates substantial exploitation interest following disclosure.

Public references include the vulnerable code path in the plugin's functions.php file on the WordPress Trac repository and a detailed entry from Wordfence threat intelligence. No information on patches, version updates, or specific mitigation steps is provided in the available references.