CVE-2024-5792

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-579215.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When runCVE-2024-579225.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [CVE-2024-579235.5In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path SincCVE-2024-579245.5In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file hCVE-2024-579257.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_rCVE-2024-579267.8In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bCVE-2024-579275.5In the Linux kernel, the following vulnerability has been resolved: nfs: Fix oops in nfs_netfs_init_request() when copying to cache When nCVE-2024-579287.1In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecachCVE-2024-579297.1In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_eCVE-2024-57938.8The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up toCVE-2024-579305.5In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a cCVE-2024-579315.5In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended
CVE-2024-5792: High severity, CVSS 8.8 | Vulnix