CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fahad Mahmood Order Splitter for WooCommerce woo-order-splitter allows SQL Injection.This issue affects Order Splitter for WooCommerce: from n/a through <= 5.3.0.
Explanation of Vulnerability in Simple Terms
Order Splitter for WooCommerce versions 5.3.0 and earlier contain a SQL injection vulnerability in database queries. An attacker with low-level site access can inject malicious SQL code to read sensitive data from the database, including customer information and order details. The vulnerability also allows limited disruption of site availability.
What an attacker can do
Read sensitive data from the site database, including customer records and order information.
Potential impact on your site
Customer data and order information could be exposed; site availability may be degraded.
Conditions required to exploit
Attacker must have a low-privilege account on the WordPress site (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
