CVE-2021-24402

CVE-2021-24402 describes a SQL injection vulnerability in the WP iCommerce WordPress plugin, affecting versions through 1.1.1. The flaw resides in the 'Orders' functionality, where the 'order_id' parameter is not properly sanitized, allowing authenticated low-privilege users (e.g., contributors) to inject malicious SQL. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating that it can be exploited remotely with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.