CVE-2021-24402

CVE-2021-24402: WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection

Vendor Unknown
Product WP iCommerce – the first interactive ecommerce for wordpress
Weakness CWE-89 · SQLi
Published September 20, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors

Key dates

02Disclosure timeline

September 20, 2021 CVE published
August 3, 2024 Record updated