CVE-2024-0709 is a critical SQL injection in the Cryptocurrency Widgets, Price Ticker and Coins List plugin for WordPress, scored 9.8, in versions 2.0 to 2.6.5. No login is needed. Update the plugin to a release newer than 2.6.5 and confirm the fix in the changelog.
What's affected
The record says the Cryptocurrency Widgets (Price Ticker and Coins List) plugin for WordPress is affected in all versions up to and including 2.6.5. I could not retrieve the vendor changeset or advisory pages, so a fixed version is not confirmed here. The record says all versions up to and including 2.6.5 are affected, which implies a later release carries the fix. Check the plugin changelog on WordPress.org and the Wordfence entry before you rely on a specific number.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Note the record's range: versions 2.0 to 2.6.5, so builds before 2.0 are not listed as affected. The affected code is in the plugin's ccpw-db-helper.php file according to the reference links. The weakness class is CWE-89.
How to check if you're exposed
If you have WP-CLI access, list installed plugins and their versions:
wp plugin list --fields=name,version,status,update
Look for the cryptocurrency-price-ticker-widget row. If the version is 2.6.5 or lower, you are in the affected range. You can also open Plugins in the WordPress admin and read the version under the plugin name.
To update from the command line:
wp plugin update cryptocurrency-price-ticker-widget
Deactivated plugins still sit on disk and in some cases can still be reached by URL, so check inactive ones too.
What to do now
- Check the installed version of the plugin on every WordPress site you run, including staging copies.
- Update to the latest release and confirm in the changelog that the issue is addressed.
- If you cannot update right away, deactivate the plugin until you can, or restrict access with your web application firewall.
- Review access logs and the database for unexpected activity if the site was exposed for a long period.
- Add the plugin to the list you watch for new advisories.
Why it matters
The coinslist parameter is not escaped sufficiently and the SQL query using it is not prepared. The record says unauthenticated attackers can append additional SQL queries to the existing ones and use them to extract sensitive information from the database.
A price ticker widget looks harmless. It shows coin prices on a page. But the plugin still talks to the site database, and any code path that does so with user supplied input has to treat that input as untrusted. This is a good example of why a plugin inventory should cover every installed component, not just the ones that handle payments or logins.
The record does not mark this CVE as known exploited, and no advisory I fetched says it is. Plugin flaws like this are still scanned for in bulk once they are public, so patch windows matter more than the exact score.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
The record says 2.0 to 2.6.5. Update to a newer release regardless of where you sit in that range.
Is this the same bug class as CVE-2024-0705?
Yes, both are SQL injection in WordPress plugins from the same week, but they affect different plugins and need separate updates.
Sources
Last reviewed: 19 October 2026.
