Vulnerability · Published Jan 7, 2025 · Assigned by Patchstack

CVE-2024-56290WordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerability

Critical 9.3

In plain English

A critical-severity SQL injection in Multiple Shipping And Billing Address For Woocommerce from silverplugins217. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.4%top 64.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.2.

Affected products (as reported)

Vendor	Product	Versions
silverplugins217	Multiple Shipping And Billing Address For Woocommerce	0 – through 1.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

References

https://patchstack.com/database/Wordpress/Plugin/different-shipping-and-billing-address-for-woocommerce/vulnerability/wordpress-multiple-shipping-and-billing-address-for-woocommerce-plugin-1-2-unauthenticated-sql-injection-vulnerability?_s_id=cve vdb-entry