{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atemplateinvadersti_woocommerce_wishlistwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:free:wordpress:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2024-43917"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ti Woocommerce Wishlist (\u003c= 2.8.2)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","sqli","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["Templateinvaders"],"content_html":"\u003cp\u003eCVE-2024-43917 is a critical SQL injection vulnerability in the TI WooCommerce Wishlist WordPress plugin. The vulnerability exists in the /wc/v3/wishlist/{share_key}/get_products endpoint. Unauthenticated attackers can exploit this flaw by injecting malicious SQL payloads into the 'order' parameter. Successful exploitation permits attackers to retrieve sensitive database information, including user credentials and configuration details. Public exploit scripts are available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized database access, which may lead to total compromise of the WordPress site, including administrative credential theft and modification of site data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;TI WooCommerce Wishlist\u0026quot; plugin to a version beyond 2.8.2 immediately.\u003c/li\u003e\n\u003cli\u003eIf an update is not immediately possible, restrict external access to the /wc/v3/wishlist/ endpoint via web application firewall (WAF) rules.\u003c/li\u003e\n\u003cli\u003eReview database query logs for suspicious activity targeting the 'order' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:46:34Z","date_published":"2026-10-29T00:46:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43917/","summary":"An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.","title":"Templateinvaders Ti WooCommerce Wishlist: Unauthenticated SQL Injection (CVE-2024-43917)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43917/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}