PT-2024-39476 · Funnelkit · Recover Woocommerce Cart Abandonment

Ery4Ng0615 + 1 · Published 2024-11-14 · Updated 2025-05-15 · CVE-2024-9186

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin versions prior to 3.3.0

Description The issue allows unauthenticated users to perform SQL injection attacks due to the lack of sanitization and escaping of the bwfan-track-id parameter before using it in a SQL statement.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL statement that uses the bwfan-track-id parameter until a patch is available. Avoid using the bwfan-track-id parameter in affected SQL statements until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-9186

Affected Products

Recover Woocommerce Cart Abandonment

References · 10

• 🔥 https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9186 · Security Note
• https://t.me/cvedetector/10907 · Telegram Post
• https://t.me/cvenotify/101645 · Telegram Post
• https://t.me/cvenotify/122370 · Telegram Post
• https://twitter.com/CVEnew/status/1857065028999868579 · Twitter Post
• https://t.me/cvenotify/101870 · Telegram Post
• https://twitter.com/cracbot/status/1858752113586897255 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857097485405053182 · Twitter Post