CVE-2024-32087: 
WordPress vulnerability analysis and mitigation

The Product Feed on WooCommerce for Google plugin for WordPress contains an SQL Injection vulnerability (CVE-2024-32087) affecting versions up to and including 3.5.7. The vulnerability was discovered by Le Ngoc Anh and publicly disclosed on April 11, 2024 (WPScan, Patchstack).

The vulnerability is classified as an SQL Injection (CWE-89) due to insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries. The vulnerability has received a CVSS v3.1 base score of 7.6 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L (Patchstack).

This vulnerability allows authenticated attackers with administrator-level access to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (WPScan).

The vulnerability requires administrator-level authentication to exploit, which somewhat limits its potential impact. However, once an attacker has the necessary access level, the exploitation process is relatively straightforward due to the low attack complexity (Patchstack).

Currently, there is no known fix available for this vulnerability. Users of the affected plugin versions should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).