CVE-2024-37112 CRITICAL

CVE-2024-37112: WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability

Vendor Membership Software
Product WishList Member X
Weakness CWE-89 · SQLi
Published July 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.

Explanation of Vulnerability in Simple Terms

02Summary

WishList Member X versions before 3.26.7 contain a SQL injection vulnerability in the database query handling. An attacker can inject malicious SQL commands through user input without authentication. This allows complete compromise of the site database, including reading sensitive data, modifying records, and disrupting service. All sites running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete any data in the site database without logging in.

Potential impact on your site

04Site Impact

Complete database compromise: user credentials, payment info, and all site data at risk.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-61955 WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability CVE-2026-57832 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 CVE-2026-59525 WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability CVE-2026-65766 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1