CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows SQL Injection.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.8.9.
Explanation of Vulnerability in Simple Terms
MC Woocommerce Wishlist versions 1.8.9 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or shop manager access can craft malicious input to read sensitive database information, including customer data and order details. The vulnerability requires administrative credentials to exploit but can expose confidential information across the entire site.
What an attacker can do
Read sensitive data from the site's database, including customer information and order records.
Potential impact on your site
Customer data and order information stored in the database could be exposed to malicious administrators or compromised admin accounts.
Conditions required to exploit
Attacker must have admin or shop manager access to the WordPress site.
Key dates
External resources
Related vulnerabilities
