CVE-2024-9186
Last modified
CVE-2024-9186 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. EPSS estimates a 2.24% chance of exploitation in the next 30 days.
Description
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Funnelkit | Funnelkit Automations | < 3.3.0 |
References
- https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9186?
How severe is CVE-2024-9186?
How do I fix CVE-2024-9186?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-9180A privileged Vault operator with write permissions to the ro…7.2
- CVE-2024-9181Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-9182The Maspik WordPress plugin before 2.1.3 does not sanitise …4.8
- CVE-2024-9183GitLab has remediated an issue in GitLab CE/EE affecting all…6.4
- CVE-2024-9184The SendPulse Free Web Push plugin for WordPress is vulnerab…7.2
- CVE-2024-9185Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-9187The Read more By Adam plugin for WordPress is vulnerable to …4.3
- CVE-2024-9188Specially constructed queries cause cross platform scripting…8.8
- CVE-2024-9189The EU/UK VAT Manager for WooCommerce plugin for WordPress i…5.3
- CVE-2024-9191The Okta Device Access features, provided by the Okta Verify…7.8
- CVE-2024-9192The WordPress Video Robot - The Ultimate Video Importer plug…8.8
- CVE-2024-9193The WHMpress - WHMCS WordPress Integration Plugin plugin for…9.8
Are you affected by CVE-2024-9186?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST