CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability exists in Dynamic Pricing With Discount Rules for WooCommerce versions up to 4.5.8. An authenticated administrator can inject malicious SQL code through unfiltered input, potentially reading sensitive database information. The vulnerability requires high-level admin privileges and does not affect data integrity or site availability.
What an attacker can do
Read sensitive data from the site's database, such as customer information or configuration details.
Potential impact on your site
An admin account compromise could expose customer data and business information stored in your database.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
