CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
Explanation of Vulnerability in Simple Terms
Ni WooCommerce Cost Of Goods versions 3.2.8 and earlier contain a SQL injection vulnerability in a high-privilege function. An authenticated admin can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive database records. The vulnerability requires admin access and does not allow data modification, but can expose confidential information and cause service disruption.
What an attacker can do
Read sensitive data from the site's database by injecting SQL commands through an admin function.
Potential impact on your site
An admin account compromised or misused could expose customer data, order details, and other database records.
Conditions required to exploit
Attacker must have admin-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
