Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2024-1698
CVE-2024-1698:
WordPress vulnerability analysis and mitigation
Overview
The NotificationX WordPress plugin (versions up to 2.8.2) contains a critical SQL Injection vulnerability (CVE-2024-1698) discovered in February 2024. The vulnerability exists in the 'type' parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation. This security flaw affects over 30,000 installations of the plugin (Security Online).
Technical details
The vulnerability received a CVSS v3.1 score of 9.8 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw allows unauthenticated attackers to append additional SQL queries to existing queries due to improper input sanitization of the 'type' parameter (NVD, Wordfence).
Impact
The successful exploitation of this vulnerability could lead to unauthorized access to sensitive database information, including usernames, hashed passwords, and customer information. Additionally, attackers could potentially manipulate database contents, leading to website defacement and potential distribution of malware (Security Online).
Mitigation and workarounds
Website administrators running affected versions of the NotificationX plugin should immediately update to version 2.8.3 or later, which contains the security patch. No alternative workarounds are currently available (Security Online).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management