CVE-2024-12416

Summary

CVE-2024-12416: The Live Sales Notification plugin for Woomotiv, used with Woocommerce in WordPress, contains a vulnerability that allows unauthenticated attackers to conduct SQL Injection attacks. This issue stems from insufficient escaping of user-supplied parameters and the lack of adequate preparation of existing SQL queries in all versions up to 3.6.1. Attackers can exploit this flaw to add supplementary SQL queries to the existing ones, potentially extracting sensitive data from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.