CVE-2024-13234 is a high severity (CVSS 7.5) SQL injection in the Product Table by WBW plugin for WordPress, through the additionalCondition parameter, in versions up to and including 2.1.2. Unauthenticated attackers can extract data from the database. Update past 2.1.2 or remove the plugin.
What's affected
- Product Table by WBW, all versions up to and including 2.1.2.
- The injectable value is the additionalCondition parameter.
The record does not name a fixed version, but it links a code changeset in the plugin repository. Check the plugin page for a release newer than 2.1.2.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i product
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the plugin to the newest release and confirm the version is above 2.1.2.
- If your product tables do not need filtering features that use the parameter, deactivate the plugin until updated.
- If your site was exposed, consider rotating secrets stored in the database, and review user records for unexpected changes.
- Look up CVE-2024-13234 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says the parameter is not escaped enough and the existing query is not prepared. That combination lets an outsider append their own SQL to a query the plugin builds. The CVSS vector reflects a read-only effect, so the concern is information disclosure, but on a WooCommerce site the database holds customer names, addresses and order history.
This CVE is an SQL injection flaw (CWE-89, SQL Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
SQL injection happens when user input is placed into a database query as if it were part of the query itself. The database cannot tell which parts were written by the developer and which were supplied by a visitor, so it runs both.
The standard cure is prepared statements with bound parameters, plus escaping and validation as a second layer. The record points at missing escaping and missing query preparation, which is the usual pattern. Here the confidentiality impact is high and integrity and availability are not affected in the CVSS vector, so the main concern is data leaving the database: user records, order data and stored secrets.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is login required?
No. The record says unauthenticated attackers can exploit it.
Does the flaw change data?
The CVSS vector rates integrity and availability impact as none. The main impact is data exposure.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
