CVE-2022-30998 CRITICAL

CVE-2022-30998: WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

Vendor Wooplugins.co
Product Homepage Product Organizer for WooCommerce (WordPress plugin)
Weakness CWE-89 · SQLi
Published July 22, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

What the vulnerability does

01Description

Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Homepage Product Organizer for WooCommerce plugin version 1.1 and earlier contains a SQL injection vulnerability in its database queries. An authenticated user with low privileges can inject malicious SQL code through plugin parameters, potentially reading sensitive data from the WordPress database and modifying store content. The vulnerability affects multiple database operations and has a high CVSS score of 9.1.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the WordPress database and modify store content via SQL injection.

Potential impact on your site

04Site Impact

Store data, customer information, and product details could be exposed or altered by any low-privilege user.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

July 22, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12753 Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter CVE-2026-14782 Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import CVE-2026-65462 WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability CVE-2026-61950 WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection