CVE-2024-49691: 
WordPress vulnerability analysis and mitigation

CVE-2024-49691 is a SQL Injection vulnerability discovered in the Woobewoo Product Filter by WBW WordPress plugin affecting versions up to 2.7.0. The vulnerability was reported by researcher Hakiduck and published on October 21, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') with a CVSS v3.1 base score of 7.6 (High). The attack vector is Network (N) with Low attack complexity (L), requiring High privileges (H) and No user interaction (UI). The scope is Changed (C) with High confidentiality impact (H), No integrity impact (N), and Low availability impact (L) (Patchstack).

This vulnerability could allow a malicious actor with administrator privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information. The severity is considered high due to the potential for data theft, although the impact is somewhat limited by the requirement for administrator privileges (Patchstack).

The vulnerability has been fixed in version 2.7.1 of the Product Filter by WBW plugin. Users are advised to update to version 2.7.1 or later to remove the vulnerability (Patchstack).