CVE-2024-51818

FAUCET Score

CVE-2024-51818 is a critical SQL Injection vulnerability (CWE-89) affecting the Fancy Product Designer plugin for WordPress, specifically versions up to and including 6.4.3. This flaw allows unauthenticated attackers to execute arbitrary SQL commands remotely over the network with low complexity, potentially leading to high confidentiality impact and low availability impact. While there are no known public exploits or Metasploit modules, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of awareness and potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0, <= 6.4.3CPE match	cpe:2.3:a:radykal:fancy_product_designer::::::wordpress::*

CVSS Data

CVSS version used by this source: 3.1

9.3CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

4.7

CvssVersion

3.1

Exploit Intelligence

EPSS Score

16.26%

Probability of exploitation in next 30 days

EPSS Percentile

96.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.1626 is in the 93rd percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Remediation records are not available for this CVE.

References

patchstack.com / database/Wordpress/Plugin/fancy-product-designer/vulnerability/wordpress-fancy-product-designer-plugin-6-4-3-unauthenticated-sql-injection-vulnerability