CVE-2024-51818

CRITICAL

Fancy Product Designer <6.4.3 - SQL Injection

Title source: llm

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Fancy Product Designer. This issue affects Fancy Product Designer: from n/a through 6.4.3.

Exploits (2)

github WORKING POC 40 stars

by iSee857 · pythonpoc

https://github.com/iSee857/CVE-PoC/tree/main/WordPressFancyProductDesigner_CVE-2024-51818_SqlInjection.py

View Code ZIP pw:eip

nomisec WORKING POC

by RandomRobbieBF · poc

https://github.com/RandomRobbieBF/CVE-2024-51818

View Code ZIP pw:eip

References (1)

[Third Party Advisory] https://patchstack.com/database/wordpress/plugin/fancy-product-designer/vulnerability/wordpress-fancy-product-designer-plugin-6-4-3-unauthenticated-sql-injection-vulnerability?_s_id=cve

Scores

CVSS v3 9.3

EPSS 0.1926

EPSS Percentile 95.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Classification

CWE

CWE-89

Status draft

Timeline

Published Jan 21, 2025

Tracked Since Feb 18, 2026