CVE-2021-24835
08.11.2021, 18:15
The WCFM Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
| Vendor | Product | Version |
|---|---|---|
| wclovers | frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible | 𝑥 < 6.5.12 |
𝑥
= Vulnerable software versions