CVE-2024-6365

🗓️ 09 Jul 2024 03:33:03Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution via 'saveCustomTitle' functio

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-6365	9 Jul 202406:48	–	circl
Cvelist	CVE-2024-6365 Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution	9 Jul 202403:33	–	cvelist
NVD	CVE-2024-6365	9 Jul 202404:15	–	nvd
Patchstack	WordPress Product Table by WBW plugin <= 2.0.1 - Unauthenticated Remote Code Execution vulnerability	9 Jul 202406:21	–	patchstack
Patchstack	WordPress Product Table by WBW Plugin <= 2.0.1 is vulnerable to Remote Code Execution (RCE)	9 Jul 202400:00	–	patchstack
Positive Technologies	PT-2024-37569 · Wbw · The Product Table	8 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-6365	5 Feb 202502:54	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2024-6365	8 Jul 202400:00	–	vulncheck_kev
Vulnrichment	CVE-2024-6365 Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution	9 Jul 202403:33	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (July 8, 2024 to July 14, 2024)	18 Jul 202415:33	–	wordfence

Vulners

Vulnrichment

Node

woobewoo product_table_for_woocommerce_by_wbwRange≤2.0.1wordpress

[
  {
    "vendor": "woobewoo",
    "product": "Product Table for WooCommerce by WBW",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php
plugins	www.plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a
plugins	www.plugins.trac.wordpress.org/changeset/3113335/

Parameter	Position	Path	Description	CWE
customTitle	request body	/wp-content/plugins/product-table-wbw/languages/customTitle.php	Unauthenticated remote code execution via unsanitized appended data in saveCustomTitle() (languages/customTitle.php) of the Product Table WBW WordPress plugin.	CWE-94

17 Jun 2026 08:17Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.01211

SSVC

CWE-94