Skip to content
Threat Feed
Subscribe
critical advisory

Templateinvaders Ti WooCommerce Wishlist: Unauthenticated SQL Injection (CVE-2024-43917)

An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.

CVE search metadata

CVE search record: CVE-2024-43917. Severity: critical. CVSS: 9.3. EPSS: 22.96%. KEV: no. Product: Ti Woocommerce Wishlist (<= 2.8.2). Brief: Templateinvaders Ti WooCommerce Wishlist: Unauthenticated SQL Injection (CVE-2024-43917). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43917/

Triage facts

Revision 1
Applicability
Ti Woocommerce Wishlist (<= 2.8.2)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 1Oct 29, 00:46 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2024-43917 is a critical SQL injection vulnerability in the TI WooCommerce Wishlist WordPress plugin. The vulnerability exists in the /wc/v3/wishlist/{share_key}/get_products endpoint. Unauthenticated attackers can exploit this flaw by injecting malicious SQL payloads into the 'order' parameter. Successful exploitation permits attackers to retrieve sensitive database information, including user credentials and configuration details. Public exploit scripts are available.

Impact

Successful exploitation allows for unauthorized database access, which may lead to total compromise of the WordPress site, including administrative credential theft and modification of site data.

Recommendation

  • Update the "TI WooCommerce Wishlist" plugin to a version beyond 2.8.2 immediately.
  • If an update is not immediately possible, restrict external access to the /wc/v3/wishlist/ endpoint via web application firewall (WAF) rules.
  • Review database query logs for suspicious activity targeting the 'order' parameter.

Immediate actions

Update TI WooCommerce Wishlist plugin to version > 2.8.2

IT Operations 24h

Threat Hunt

Inspect web server logs for anomalous order parameter values containing SQL keywords

T1190 high high confidence hunt now

Data: cs-uri-query field

Mitigations

Apply WAF rules to block requests containing SQL metacharacters in the order parameter

immediate IT Operations

CVE-2024-43917

Detection coverage 1

Detects CVE-2024-43917 Exploitation - SQL Injection in TI WooCommerce Wishlist

critical

Detects attempts to exploit CVE-2024-43917 by monitoring for suspicious SQL injection patterns within the order parameter of the Wishlist API endpoint.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →