CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
The CSV Product Import Export for WooCommerce plugin contains a SQL injection vulnerability in versions up to 1.0.0. An authenticated user with low privileges can craft malicious input to execute arbitrary SQL queries against the site's database. This can expose sensitive data including customer information, order details, and site configuration. The vulnerability requires an authenticated account but no user interaction.
What an attacker can do
Read or modify database contents, including customer data, orders, and site configuration.
Potential impact on your site
Customer data, orders, and site settings may be exposed or altered by an authenticated attacker.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
