Description
The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | TI WooCommerce Wishlist | < 2.0.7 | 2.0.7 |
References
- https://wpscan.com/vulnerability/d0119edb-2845-4106-a2bf-0ef28949ae32/ exploit vdb-entry technical-description