67 matches found
CVE-2025-11391
PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res; 未認証の攻撃者は、悪意のあるペイロードを作成し、商品をカートに追加する際に ppomfieldsid パラメータに注入することで、この脆弱性を悪用できます。これにより、攻撃者は時間遅延関数（SLEEP）などの任意のSQLコマンドを実行でき、脆弱性を確認したり、データベースから機密情報を1文字ずつ外部に持ち出したりすることが可能になります。...
CVE-2025-11391
PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res; 인증되지 않은 공격자는 악의적인 페이로드를 제작하여 장바구니에 제품을 추가할 때 ppomfieldsid 매개변수에 주입함으로써 이 취약점을 악용할 수 있습니다. 이를 통해 공격자는 지연 함수SLEEP와 같은 임의의 SQL 명령을 실행할 수 있으며, 취약점을 확인하고 데이터베이스에서 민감한 정보를 문자 단위로 유출할 ...
CVE-2026-56050
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18...
CVE-2026-56050
CVE-2026-56050 affects the WordPress PPOM for WooCommerce plugin (Themeisle) up to version 33.0.18. The issue is described as an Improper Access Control vulnerability, arising from incorrectly configured access control security levels within the PPOM for WooCommerce feature set. The available doc...
WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HaiND in WordPress Plugin PPOM for WooCommerce versions = 33.0.18...
CVE-2026-56050: Improper Access Control
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18...
📄 PPOM for WooCommerce 33.0.15 SQL Injection / Code Execution
This is an extensive exploit that leverages a remote SQL injection vulnerability in PPOM for WooCommerce version 33.0.15 to also achieve remote code execution and local file inclusion...
CVE-2025-66069
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...
CVE-2025-66069
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...
CVE-2025-66069 WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...
CVE-2025-66069
CVE-2025-66069 (WordPress PPOM for WooCommerce) is a Missing Authorization / Broken Access Control vulnerability affecting PPOM for WooCommerce versions up to 33.0.16. The issue, reported by Legion Hunter, arises from incorrectly configured access controls in the woocommerce-product-addon feature...
CVE-2025-66069: Missing Authorization
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...
WordPress plugin PPOM for WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...
WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin PPOM for WooCommerce versions = 33.0.16...
CVE-2025-11691
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOMMeta::getfieldsbyid function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2025-34971
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOMMeta::getfieldsbyid function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2025-11691
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOMMeta::getfieldsbyid function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2025-11691
The CVE-2025-11691 entry concerns the PPOM – Product Addons & Custom Fields for WooCommerce WordPress plugin. A SQL Injection exists in PPOM_Meta::get_fields_by_id() for all versions up to 33.0.15 due to insufficient escaping of user input and inadequate query preparation. The vulnerability is ex...
CVE-2025-11391 PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to uplo...
WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 33.0.15 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin PPOM for WooCommerce versions = 33.0.15...