CVE-2024-56290

CVE-2024-56290 is an SQL injection vulnerability (CWE-89) in the WordPress plugin "Multiple Shipping And Billing Address For Woocommerce" (slug: different-shipping-and-billing-address-for-woocommerce) developed by silverplugins217. The flaw stems from improper neutralization of special elements used in an SQL command, allowing attackers to inject malicious SQL payloads. It affects all versions of the plugin up to and including 1.2.

The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Unauthenticated attackers can exploit it remotely over the network with low complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, such as extracting sensitive data from the database, alongside low availability disruption and a changed scope affecting broader system components.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/different-shipping-and-billing-address-for-woocommerce/vulnerability/wordpress-multiple-shipping-and-billing-address-for-woocommerce-plugin-1-2-unauthenticated-sql-injection-vulnerability?_s_id=cve provides details on the unauthenticated SQL injection in version 1.2 and recommends mitigation steps, though specific patch availability or workarounds are outlined in the full report.