CVE-2024-9186 | THREATINT

Assigner	WPScan
Reserved	2024-09-25
Published	2024-11-14
Updated	2024-11-15

Description

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Product status

Default status

unaffected

Any version before 3.3.0

affected

Credits

y4ng0615 finder

WPScan coordinator

References

https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26/ exploit vdb-entry technical-description

cve.org CVE-2024-9186

nvd.nist.gov CVE-2024-9186

Download JSON

https://cve.threatint.com/CVE/CVE-2024-9186

Support options

Helpdesk Telegram

Subscribe to our newsletter to learn more about our work.