CVE-2024-6723 AI Engine < 2.4.8 - Admin+ SQLi
Admin users can exploit SQL injection in AI Engine plugin to read or modify database contents via chatbot discussions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6723?
CVE-2024-6723 is a medium-severity SQL injection vulnerability in Unknown AI Engine, published on 13 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.
Weakness: CWE-89
Which versions are affected by CVE-2024-6723?
It affects 1 product.
Products include Meowapps Ai Engine.
How do I fix CVE-2024-6723?
No fix has been published for CVE-2024-6723 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-6723 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6723 exists.
Other vulnerabilities in Unknown AI Engine
- CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
- CVE-2024-34440 WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability
- CVE-2024-29100 WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability
- CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
- CVE-2025-6238 AI Engine 2.8.4 - Insecure OAuth Implementation
Sources
Also known as GHSA-gr4h-g2ph-j8j2.