CVE-2024-33551: 
WordPress vulnerability analysis and mitigation

A critical SQL Injection vulnerability (CVE-2024-33551) was discovered in the 8theme XStore Core WordPress plugin, affecting versions up to 5.3.5. The vulnerability was disclosed on April 25, 2024, and allows unauthenticated attackers to perform SQL injection attacks against WordPress websites running the vulnerable plugin (Patchstack).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries in the XStore Core plugin. This security flaw has received a CVSS v3.1 base score of 9.8 (Critical) from NIST and 9.3 (Critical) from Patchstack, indicating its severe nature. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD).

The SQL injection vulnerability allows unauthenticated attackers to append additional SQL queries to existing ones, potentially enabling them to extract sensitive information from the database. This could lead to unauthorized access to sensitive data, database compromise, and potential website takeover (Security Online).

The vulnerability is particularly severe as it requires no authentication to exploit, making it accessible to any remote attacker. The issue has been confirmed to be known to be exploited in the wild, increasing the urgency for patching (WPScan).

The vulnerability has been patched in XStore Core plugin version 5.3.9. Website administrators are strongly advised to update to this version immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).