CVE-2024-37109

Severity

CRITICAL

CVSS

9.9

EPSS

0.00532

Risk score

39.79

CISA KEV

PoC

Published

2024-06-24

Modified

2026-04-28

First seen

2026-08-07

Aliases

EUVD-2024-36432, GHSA-X6PP-PCHX-WVC7

Products

Membership Software:WishList Member X n/a <3.26.7

Sources

euvd EUVD-2024-36432

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishList Member X: from n/a before 3.26.7.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-36432
https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-arbitrary-php-code-execution-vulnerability?_s_id=cve