CVE-2021-24849

PoC —

CVSS 3.1

9.8 critical

EPSS

8%p95

Published

Dec 21, 2021 (Dec 21, 2021)

Modified

Jun 17, 2026

Description

The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections

Vendors: wclovers
Products: frontend manager for woocommerce along with bookings subscription listings compatible
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.5%)

In the news0 stories

No ingested article mentions this CVE yet.