CVE-2024-49666

CVE-2024-49666 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the ARPrice WordPress plugin developed by reputeinfosystems. The issue impacts all versions of ARPrice from n/a through 4.1.3 inclusive.

The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating it can be exploited remotely over the network with low complexity by low-privileged users without requiring user interaction. Successful exploitation enables high-impact confidentiality violations across scopes, such as extracting sensitive data from the database, alongside low availability impact.

Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/arprice/vulnerability/wordpress-arprice-plugin-4-0-3-sql-injection-vulnerability?_s_id=cve, provide details on the vulnerability in the WordPress ARPrice plugin.