CVE-2023-2843

EUVD-2023-34294
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
multiparcelsmultiparcels_shipping_for_woocommerce
𝑥
< 1.14.15
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/8e713eaf-f332-47e2-a131-c14222201fdc
https://wpscan.com/vulnerability/8e713eaf-f332-47e2-a131-c14222201fdc