CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors.This issue affects WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: from n/a through 2.4.7.
Explanation of Vulnerability in Simple Terms
WC Vendors contains a SQL injection vulnerability in its database query handling. An attacker with high-level privileges can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the database. The vulnerability affects versions up to 2.4.7 and impacts confidentiality and availability of the site.
What an attacker can do
Read sensitive data from the site's database, such as customer information, orders, and payment details.
Potential impact on your site
Customer data, order records, and payment information could be exposed to a malicious admin or vendor account.
Conditions required to exploit
Attacker must have high-level admin or vendor account privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
