CVE-2024-9130

Summary

CVE-2024-9130 is a vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform for WordPress. This issue allows authenticated attackers with Manager-level access and above to execute time-based SQL Injections via the 'order' parameter. The plugin fails to properly escape user-supplied input and prepare existing SQL queries, enabling attackers to append malicious queries into existing ones. In the Legacy View mode, these queries can be used to extract sensitive information from the database. This vulnerability impacts all versions of the plugin up to and including 3.16.1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.