CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.
Explanation of Vulnerability in Simple Terms
Product Vendors for WooCommerce contains a SQL injection vulnerability in versions up to 2.1.78. An authenticated user with high privileges can craft malicious input to execute arbitrary SQL queries against the site's database. This allows reading or modifying sensitive data, though the attacker cannot delete data or take the site offline. The vulnerability requires admin-level access to exploit.
What an attacker can do
Read or modify database contents via SQL injection, but cannot delete data or cause unavailability.
Potential impact on your site
A rogue admin or compromised admin account can access or alter customer data, orders, and plugin settings.
Conditions required to exploit
Attacker must have high-level admin privileges and network access to the site.
Key dates
External resources
Related vulnerabilities
