CVE-2024-9186
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Score
- CVSS 3.1 8.6 High
- Status
- Analyzed - contact@wpscan.com
- Published
- 2024-11-14
- Last modified
- 2024-11-15
- Weaknesses
- CWE-89
Affected products
- Funnelkit Automations (Funnelkit)
- Email Marketing (Unknown)
- Marketing Automation By Funnelkit (Unknown)
- Newsletter (Unknown)
- Recover Woocommerce Cart Abandonment (Unknown)
References
- https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26/
