CVE-2021-24928
Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection
- State
- Published
- Severity
- Not scored
- Published
- Feb 7, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
Scores
The record has no CVSS score.
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
Rearrange Woocommerce ProductsUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.