CVE-2024-6365
CRITICAL
9.8
CVSS 3.1
Description
The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.
Affected WordPress components
-
woo-product-tables Plugin · woo-product-tablesUp to and including 2.0.1View on WordPress.org
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- woobewoo Product Table for WooCommerce by WBW — Up to and including 2.0.1
- woobewoo product_table_by_wbw — Up to and including 2.0.1
References
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php#L7
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3113335/
- www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=cve
- nvd.nist.gov Official NVD record