CVE-2024-6365

EUVD-2024-47472
The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
woobewooproduct_table_by_wbw
𝑥
≤ 2.0.1
ADP
Common Weakness Enumeration
References
https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php
https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php#L7
https://plugins.trac.wordpress.org/changeset/3113335/
https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=cve
https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php
https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php#L7
https://plugins.trac.wordpress.org/changeset/3113335/
https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=cve