PT-2024-26889 · WordPress · Music Store

Daiki Sato · Published 2024-06-06 · Updated 2024-10-30 · CVE-2024-36082

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Music Store - WordPress eCommerce versions prior to 1.1.14

Description A SQL injection issue allows a remote authenticated attacker with administrative privileges to execute arbitrary SQL commands, potentially obtaining or altering information stored in the database.

Recommendations For versions prior to 1.1.14, update to version 1.1.14 or later to resolve the issue. As a temporary workaround, consider restricting administrative access to trusted users until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-36082

Affected Products

Music Store

References · 9

• https://osv.dev/vulnerability/CVE-2024-36082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36082 · Security Note
• https://wordpress.org/plugins/music-store · Note
• https://plugins.trac.wordpress.org/changeset?new=3085975%40music-store%2Ftrunk%2Fmusic-store.php&old=3079647%40music-store%2Ftrunk%2Fmusic-store.php · Note
• https://twitter.com/VulmonFeeds/status/1798950790167691267 · Twitter Post
• https://twitter.com/CVEnew/status/1798925692081721621 · Twitter Post
• https://jvn.jp/en/jp/JVN79213252 · Note
• https://t.me/cvenotify/82235 · Telegram Post
• https://t.me/cvenotify/86541 · Telegram Post