CVE-2024-13726 Scanner

The Themes Coder Ecommerce plugin is a popular WordPress extension that enables small businesses and entrepreneurs to build online stores with minimal technical effort. It integrates seamlessly with WordPress, providing features like product catalogs, payment gateways, and shopping cart management. Developers and site administrators rely on it for robust ecommerce functionality, and its community support has historically ensured regular updates and reliability.

CVE-2024-13726 is a SQL Injection vulnerability that arises due to insufficient sanitization and escaping of user-supplied input in an AJAX action. This flaw allows unauthenticated attackers to inject arbitrary SQL queries into the database. The root cause is the lack of proper parameter validation, which enables malicious SQL statements to be executed directly against the WordPress database.

The vulnerability specifically targets an AJAX endpoint within the Themes Coder Ecommerce plugin. By sending crafted requests to this endpoint, an attacker can manipulate SQL queries through unsanitized parameters. This allows them to bypass authentication and execute arbitrary SQL commands, potentially extracting sensitive data or modifying database contents.

If exploited, this vulnerability can lead to complete database compromise, including theft of user credentials, personal data, and payment information. Attackers may also gain administrative access to the WordPress site, enabling further malicious activities such as defacement, malware injection, or data exfiltration. The high CVSS score of 8.2 underscores the critical risk to affected sites.