Description
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WCFM Marketplace – Best Multivendor Marketplace for WooCommerce | 3.4.12 – < 3.4.12 | 3.4.12 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection http/cves/2021/CVE-2021-24849.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.