Vulnerability · Published Feb 17, 2025 · Assigned by WPScan

CVE-2024-13726Themes Coder <= 1.3.4 - Unauthenticated SQLi

High 8.6

In plain English

A high-severity security flaw in Themes Coder from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected products (as reported)

Vendor	Product	Versions
Unknown	Themes Coder	0 – through 1.3.4

References

https://wpscan.com/vulnerability/ec226d22-0c09-4e7c-86ec-b64819089b60/ exploit, vdb-entry, technical-description