CVE-2017-12199

Critical

Published: 02/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Etoile Ultimate Product Catalog plugin version 4.2.11 for WordPress has an SQL injection vulnerability in several POST actions in the wp-admin/admin-ajax.php file.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized access to the database, threatening the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.