PT-2024-4545 · 8Theme · 8Theme Xstore

Rafie Muhammad · Published 2024-04-25 · Updated 2025-06-12 · CVE-2024-33559

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: 8theme XStore versions n/a through 9.3.5

Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This can enable a remote attacker to execute arbitrary SQL queries to the database.

Recommendations: For versions n/a through 9.3.5, update to a version later than 9.3.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database queries until a patch is available. Avoid using user-supplied input in SQL queries to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-05049

CVE-2024-33559

Affected Products

8Theme Xstore

References · 13

• 🔥 https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection · Exploit
• 🔥 https://exploit-db.com/exploits/52019 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33559 · Security Note
• https://bdu.fstec.ru/vul/2024-05049 · Security Note
• https://twitter.com/linuxpatch/status/1784842816515985561 · Twitter Post
• https://twitter.com/absholi_ly/status/1791324883034505302 · Twitter Post
• https://twitter.com/CVEnew/status/1784834872496021870 · Twitter Post
• https://t.me/cvenotify/78312 · Telegram Post
• https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/pdnuclei_bot/status/1933147288701907034 · Twitter Post
• https://twitter.com/ksg93rd/status/1793342127436415433 · Twitter Post
• https://t.me/cybersecuritytechnologies/10540 · Telegram Post
• https://twitter.com/cracbot/status/1785246822987923874 · Twitter Post