CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock: from n/a through <= 3.13.1.
Explanation of Vulnerability in Simple Terms
FlexStock versions up to 3.13.1 contain a SQL injection vulnerability in database query handling. An authenticated administrator can inject malicious SQL code to read sensitive data from the database, including user credentials and site configuration. The vulnerability requires high-level privileges to exploit and does not allow data modification.
What an attacker can do
Read sensitive data from the site's database, including user information and configuration details.
Potential impact on your site
If a compromised admin account exists, attackers can extract user data, passwords, and site secrets from your database.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
