CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.
Explanation of Vulnerability in Simple Terms
FooEvents for WooCommerce versions up to 1.20.4 contain a SQL injection vulnerability in database queries. An attacker with low-level user access can craft malicious input to extract sensitive data from the site's database, including customer information and order details. The vulnerability also allows limited disruption of site availability.
What an attacker can do
Extract sensitive data from the database, including customer records and order information.
Potential impact on your site
Customer data, payment information, and order records may be exposed to attackers with basic site access.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or subscriber role) on the site.
Key dates
External resources
Related vulnerabilities
