CVE-2024-43978CWE-89

WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability

Critical · published September 17, 2024

CVSS v3.1
9.3
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

🚨 A wayward SQL command can wreak havoc in Super Store Finder versions below 6.9.8! 🌪️ Think of it as a restaurant that serves up meals without checking the ingredients list. If a rogue chef slips in a toxic spice, it can poison the entire menu—just like this SQL injection flaw can corrupt your database and expose sensitive data. An attacker could exploit this vulnerability to manipulate your SQL commands, potentially accessing, altering, or even deleting data without breaking a sweat. That means customer information, orders, and inventory could be at their mercy—absolutely devastating for any business!

Put simply

Think of it as a restaurant that serves up meals without checking the ingredients list. If a rogue chef slips in a toxic spice, it can poison the entire menu—just like this SQL injection flaw can corrupt your database and expose sensitive data. This SQL injection vulnerability allows attackers to inject malicious SQL code through user input, bypassing normal authentication and authorization measures. It affects Super Store Finder from its initial version up to, but not including, 6.9.8, enabling unauthorized access to the database.

What to do

An attacker could exploit this vulnerability to manipulate your SQL commands, potentially accessing, altering, or even deleting data without breaking a sweat. That means customer information, orders, and inventory could be at their mercy—absolutely devastating for any business! To safeguard against this critical vulnerability, patch your Super Store Finder to version 6.9.8 or higher immediately. Additionally, implement prepared statements and parameterized queries to strengthen your database interactions against injection attacks. Stay proactive with regular security audits! You've got this! Follow these steps and you'll be a security hero in no time! 🦸‍♀️🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-09-17T22:29Z
EPSS history
Timeline
  • 17 SEP 22:29Z
    WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability
    cvelistv5