Unrated severityNVD Advisory· Published Feb 28, 2022· Updated Aug 2, 2024

TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL Injection

CVE-2022-0412

Description

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ti Woocommerce Wishlistllm-fuzzy
Range: <1.40.1
Package: https://wordpress.org/plugins/ti-woocommerce-wishlist
Templateinvaders/Ti Woocommerce Wishlistcpe-rescue2 versions
1.40.1+ 1 more
- (no CPE)range: 1.40.1
- (no CPE)range: 1.40.1

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2668899mitrex_refsource_CONFIRM
wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.060
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000