CVE-2023-2841

Summary

CVE-2023-2841 is a vulnerability affecting the Advanced Local Pickup plugin for WooCommerce on WordPress. This issue permits authenticated attackers with admin-level privileges to execute time-based SQL Injections via the id parameter. The vulnerability arises due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL queries. As a result, attackers can append additional SQL queries to the existing ones, potentially extracting sensitive information from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.