CVE-2024-9186

Automation By Autonami < 3.3.0 - Unauthenticated SQLi

High · published November 14, 2024

CVSS v3.1
8.6
EPSS
2%
Percentile
82.9
In the wild
Unconfirmed
What it is

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02272 · 82.9th percentile
Published
2024-11-14T06:00Z
EPSS history
Timeline
  • 14 NOV 06:00Z
    Automation By Autonami < 3.3.0 - Unauthenticated SQLi
    cvelistv5