Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
The WP-Advanced-Search WordPress plugin before version 3.3.9.2 contains a vulnerability where it does not sanitize and escape the 't' parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks.
This vulnerability could allow unauthenticated attackers to perform SQL injection attacks. Such attacks might result in unauthorized access to the database, potential data theft, manipulation of database contents, or even deletion of data. The impact is categorized as LOW for confidentiality, integrity, and availability, suggesting that while the vulnerability is serious, its potential for severe damage is somewhat limited.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. The vulnerability has been addressed in version 3.3.9.2 of the WP-Advanced-Search WordPress plugin. Users should update to this version or later to mitigate the risk.
1. Update the WP-Advanced-Search WordPress plugin to version 3.3.9.2 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the WP-Advanced-Search plugin until the update can be applied. 3. Implement strong input validation and sanitization practices for all user inputs, especially those used in database queries. 4. Regularly update all WordPress plugins and themes to their latest versions to ensure all known vulnerabilities are patched. 5. Implement the principle of least privilege for database users associated with the WordPress installation. 6. Use Web Application Firewalls (WAF) to help detect and block SQL injection attempts. 7. Regularly backup your WordPress database and files to ensure quick recovery in case of a successful attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2024-9796
Feedly found the first article mentioning CVE-2024-9796. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 5.9 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 9.7%)
A CVSS base score of 9.8 has been assigned.