CVE-2024-9796
Published: 10 October 2024
Summary
CVE-2024-9796 is a critical-severity SQL Injection (CWE-89) vulnerability in Internet-Formation Wp-Advanced-Search. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2024-9796 affects the WP-Advanced-Search WordPress plugin prior to version 3.3.9.2. It is an instance of CWE-89 in which the t parameter is neither sanitized nor escaped before being concatenated into a SQL statement, enabling direct injection.
Unauthenticated remote attackers can supply crafted input to the affected parameter over the network and execute arbitrary SQL queries. With a CVSS 3.1 score of 9.8, successful exploitation yields full read/write access to the database and the ability to alter or destroy data.
The WPScan advisory linked in the reference identifies the root cause and states that the issue is resolved by upgrading to 3.3.9.2 or later. The EPSS score of 0.8312 reflects a high and stable probability of exploitation since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50121
Vulnerability details
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.