CVE-2024-0786: 
WordPress vulnerability analysis and mitigation

The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress contains a time-based SQL Injection vulnerability (CVE-2024-0786) discovered in February 2024. The vulnerability affects all versions up to and including 6.9.1 and is present in the ee_syncProductCategory function (NVD).

The vulnerability exists due to insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries within the ee_syncProductCategory function. The affected parameters include conditionData, valueData, productArray, exclude and include. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST and 8.8 (HIGH) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows authenticated attackers with subscriber access or higher to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

A patch has been released to address this vulnerability. Users should upgrade to version 7.0.8 or later of the plugin (NVD).