PT-2021-16330 · WordPress · Wcfm Marketplace

Jrxnm + 1 · Published 2021-12-21 · Updated 2021-12-27 · CVE-2021-24849

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WCFM Marketplace WordPress plugin versions prior to 3.4.12

Description: The issue concerns the wcfm ajax controller AJAX action, which is accessible to both unauthenticated and authenticated users. It fails to properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections.

Recommendations: For versions prior to 3.4.12, update to version 3.4.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the wcfm ajax controller AJAX action until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24849

Affected Products

Wcfm Marketplace

References · 4

• 🔥 https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e · Exploit
• https://osv.dev/vulnerability/CVE-2021-24849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24849 · Security Note
• https://t.me/cibsecurity/34421 · Telegram Post