CVE-2024-43976CWE-89

WordPress Super Store Finder plugin <= 6.9.7 - SQL Injection vulnerability

Critical · published September 17, 2024

CVSS v3.1
9.3
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

🚨 An SQL injection vulnerability in Super Store Finder could let an attacker manipulate your database with a few crafty commands! 🔥 Think of it like a restaurant where anyone can sneak into the kitchen and change an order without anyone checking the ticket — a recipe for disaster! 🍽️ If exploited, a malicious actor could gain unauthorized access, modify data, or even delete it entirely. This could lead to significant data breaches, affecting both customer privacy and your business operations. Let’s be real, nobody wants to serve up a side of chaos!

Put simply

Think of it like a restaurant where anyone can sneak into the kitchen and change an order without anyone checking the ticket — a recipe for disaster! 🍽️ This vulnerability arises from improper handling of special characters in SQL commands, allowing attackers to inject harmful SQL queries and gain control over the database. Affected versions are those prior to and including 6.9.7.

What to do

If exploited, a malicious actor could gain unauthorized access, modify data, or even delete it entirely. This could lead to significant data breaches, affecting both customer privacy and your business operations. Let’s be real, nobody wants to serve up a side of chaos! To secure your installation, immediately update Super Store Finder to version 6.9.8 or later. Additionally, implement prepared statements in your SQL queries to further mitigate the risk of injection attacks! You've got this! Patch your systems, and you'll be back to serving securely in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-09-17T22:31Z
EPSS history
Timeline
  • 17 SEP 22:31Z
    WordPress Super Store Finder plugin <= 6.9.7 - SQL Injection vulnerability
    cvelistv5