CVE-2021-24835

WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection

State: Published
Severity: Not scored
Published: Nov 8, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks

Scores

The record has no CVSS score.

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings CompatibleUnknown	6.5.12 to before 6.5.12Affected

References

https://wpscan.com/vulnerability/c493ac9c-67d1-48a9-be21-824b1a1d56c2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.