Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter
翻译中…平台
wordpress
组件
themify-wc-product-filter
修复版本
1.4.10
CVE-2024-6027 is a critical SQL Injection vulnerability affecting the Themify – WooCommerce Product Filter plugin for WordPress. This vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to data exfiltration and compromise of the WordPress database. The vulnerability impacts versions up to and including 1.4.9. A patch is available from the vendor.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The SQL Injection vulnerability in Themify WooCommerce Product Filter allows attackers to manipulate database queries through the ‘conditions’ parameter. Successful exploitation could enable attackers to extract sensitive information such as user credentials, customer data, order details, and other confidential data stored within the WordPress database. This could lead to identity theft, financial fraud, and reputational damage. The lack of authentication requirements means that any unauthenticated user can potentially exploit this vulnerability. The potential for data breach is significant, especially given the prevalence of WooCommerce stores handling sensitive customer information.
利用背景翻译中…
CVE-2024-6027 was publicly disclosed on 2024-06-21. The vulnerability is considered high-risk due to its critical CVSS score and the ease of exploitation. No public proof-of-concept (POC) code has been widely released, but the vulnerability's nature makes it likely that exploits will emerge. Monitor security advisories and threat intelligence feeds for updates.
哪些人处于风险中翻译中…
WordPress websites utilizing the Themify – WooCommerce Product Filter plugin, particularly those running versions prior to 1.4.9, are at significant risk. E-commerce sites handling sensitive customer data are especially vulnerable, as a successful SQL Injection attack could expose valuable information. Shared hosting environments where multiple WordPress installations share the same database are also at increased risk.
检测步骤翻译中…
• wordpress / composer / npm:
grep -r "conditions'" /var/www/html/wp-content/plugins/themify-woocommerce-product-filter/• generic web:
curl -I 'https://your-wordpress-site.com/?conditions=test' # Check for SQL errors in response headers• wordpress / composer / npm:
wp plugin list | grep themify-woocommerce-product-filter• wordpress / composer / npm:
wp plugin update themify-woocommerce-product-filter攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.95% (76% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
软件包信息
- 活跃安装数
- 20K已知
- 插件评分
- 3.5
- 需要WordPress版本
- 5.0+
- 兼容至
- 6.9.4
- 需要PHP版本
- 7.2+
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2024-6027 is to upgrade the Themify – WooCommerce Product Filter plugin to a patched version. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out malicious SQL injection attempts targeting the ‘conditions’ parameter. Specifically, look for patterns indicative of SQL injection payloads. Additionally, review and sanitize all user inputs within the plugin to prevent future vulnerabilities. After upgrade, confirm by attempting a query with a known malicious payload and verifying that it is properly blocked or sanitized.
修复方法翻译中…
Actualice el plugin Themify – WooCommerce Product Filter a la última versión disponible. La vulnerabilidad de inyección SQL fue corregida en versiones posteriores a la 1.4.9. Esto evitará que atacantes no autenticados exploten la vulnerabilidad para extraer información sensible de la base de datos.
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2024-6027 — SQL Injection in Themify WooCommerce Product Filter?
CVE-2024-6027 is a critical SQL Injection vulnerability in the Themify WooCommerce Product Filter plugin for WordPress, allowing attackers to potentially extract sensitive data from the database.
Am I affected by CVE-2024-6027 in Themify WooCommerce Product Filter?
You are affected if you are using Themify WooCommerce Product Filter version 1.4.9 or earlier. Check your plugin version and upgrade immediately.
How do I fix CVE-2024-6027 in Themify WooCommerce Product Filter?
Upgrade the Themify WooCommerce Product Filter plugin to the latest patched version. If upgrading is not immediately possible, implement a WAF rule to filter malicious SQL injection attempts.
Is CVE-2024-6027 being actively exploited?
While no widespread exploitation has been confirmed, the vulnerability's ease of exploitation suggests it is likely a target for attackers. Monitor for any suspicious activity.
Where can I find the official Themify advisory for CVE-2024-6027?
Refer to the Themify website and WordPress plugin repository for the latest advisory and patch information regarding CVE-2024-6027.