Ti Woocommerce Wishlist (<= 2.8.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ti-woocommerce-wishlist--2.8.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 00:46:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTemplateinvaders Ti WooCommerce Wishlist: Unauthenticated SQL Injection (CVE-2024-43917)https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43917/Thu, 29 Oct 2026 00:46:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2024-43917/An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.CVE-2024-43917 is a critical SQL injection vulnerability in the TI WooCommerce Wishlist WordPress plugin. The vulnerability exists in the /wc/v3/wishlist/{share_key}/get_products endpoint. Unauthenticated attackers can exploit this flaw by injecting malicious SQL payloads into the 'order' parameter. Successful exploitation permits attackers to retrieve sensitive database information, including user credentials and configuration details. Public exploit scripts are available.

Impact

Successful exploitation allows for unauthorized database access, which may lead to total compromise of the WordPress site, including administrative credential theft and modification of site data.

Recommendation

  • Update the "TI WooCommerce Wishlist" plugin to a version beyond 2.8.2 immediately.
  • If an update is not immediately possible, restrict external access to the /wc/v3/wishlist/ endpoint via web application firewall (WAF) rules.
  • Review database query logs for suspicious activity targeting the 'order' parameter.
]]>criticaladvisorywordpresssqliweb-applicationcms