CVE-2023-50857
Assigner: Patchstack
Published: 2023-12-28T10:57:46.626Z
State: PUBLISHED
affected: collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: wp-marketing-automations
product: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
vendor: FunnelKit
versions: changes: at: 2.7.0
status: unaffected
lessThanOrEqual: 2.6.1
status: affected
version: n/a
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Muhammad Daffa (Patchstack Alliance)
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.<p>This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.</p>
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to&nbsp;2.7.0 or a higher version.
value: Update to 2.7.0 or a higher version.
source: discovery: EXTERNAL
title: WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection
x_generator: engine: Vulnogram 0.1.0-dev