CVE-2024-51818

published 2025-01-21

CVE-2024-51818: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer…

Priority P2 70 critical 9.3 CVSS 3.1

AV N AC L PR N UI N S C C H I N A L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
radykal	fancy_product_designer	<= 6.4.3	—

Detection & IOCs extracted from sources · hover to see the quote

• · The vulnerability remains unpatched as of the latest plugin version 6.4.3; all sites running Fancy Product Designer up to and including this version are affected. ↗
• · The vulnerability affects Fancy Product Designer versions from n/a through 6.4.3 (no fixed version available at time of disclosure). ↗
• · Patchstack's writeup provides sufficient technical detail for exploit development; active exploitation attempts against WooCommerce stores using this plugin should be anticipated. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89