What’s Vulnerable › Vulnerabilities

CVE-2024-36082

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-07 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.

Affected products

• CodePeople Music Store - WordPress eCommerce: before 1.1.14 — fixed in 1.1.14

How to fix

Upgrade to a fixed version: CodePeople Music Store - WordPress eCommerce 1.1.14. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/jp/JVN79213252/
• https://plugins.trac.wordpress.org/changeset?new=3085975%40music-store%2Ftrunk%2Fmusic-store.php&old=3079647%40music-store%2Ftrunk%2Fmusic-store.php
• https://wordpress.org/plugins/music-store/
• https://jvn.jp/en/jp/JVN79213252/
• https://plugins.trac.wordpress.org/changeset?new=3085975%40music-store%2Ftrunk%2Fmusic-store.php&old=3079647%40music-store%2Ftrunk%2Fmusic-store.php
• https://wordpress.org/plugins/music-store/

Get alerted when CVE-2024-36082 or the next vulnerability affects your stack