CVE-2022-0948

CVE-2022-0948: Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi

Vendor Unknown

Product Order Listener for WooCommerce – Play Sounds Instantly on New Orders

Weakness CWE-89 · SQLi

Published May 9, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection

Key dates

02Disclosure timeline

May 9, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0948 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-82227 WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability CVE-2026-74015 WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability