CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
Explanation of Vulnerability in Simple Terms
WooCommerce Orders & Customers Exporter versions 5.4 and earlier contain a SQL injection vulnerability in the export functionality. An attacker with low-level user access can inject malicious SQL commands through export parameters, potentially reading sensitive customer and order data from the database. The vulnerability requires authentication but no user interaction.
What an attacker can do
Read sensitive customer and order data from the database by injecting SQL commands into export requests.
Potential impact on your site
Customer personal data, order details, and payment information may be exposed to authenticated attackers with minimal privileges.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the WordPress site.
Key dates
External resources
Related vulnerabilities
