CVE-2021-24835: 
WordPress vulnerability analysis and mitigation

The WCFM – Frontend Manager for WooCommerce plugin (versions before 6.5.12) contains a SQL injection vulnerability when used in combination with other WCFM WooCommerce Multivendor plugins, such as WCFM - WooCommerce Multivendor Marketplace. The vulnerability was discovered by ZhongFu Su of Wuhan University and was publicly disclosed on October 11, 2021 (WPScan).

The vulnerability stems from improper handling of the withdrawal_vendor parameter in SQL statements. The plugin fails to properly escape this parameter before using it in database queries, which creates an SQL injection vulnerability. The issue has been assigned a CVSS score of 7.7 (High) and is classified under CWE-89 (SQL Injection) and OWASP Top 10 category A1: Injection (WPScan).

This vulnerability allows low-privilege users, such as subscribers, to perform SQL injection attacks against the affected WordPress installation. Through successful exploitation, attackers could potentially access, modify, or delete unauthorized database content (WPScan).

The vulnerability has been fixed in version 6.5.12 of the WCFM – Frontend Manager for WooCommerce plugin. Users are advised to update to this version or later to protect against potential SQL injection attacks (WPScan).