High severity7.2NVD Advisory· Published Sep 20, 2021· Updated Jun 17, 2026
CVE-2021-24402
CVE-2021-24402
Description
The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/WP iCommercedescription
- Range: <=1.1.1
Patches
Vulnerability mechanics
References
2- codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce/nvdExploitThird Party Advisory
- wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.