CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through <= 3.2.
Explanation of Vulnerability in Simple Terms
The Woocommerce Partial Shipment plugin for WordPress contains a SQL injection vulnerability in versions 3.2 and earlier. An authenticated user with low privileges can inject malicious SQL code through unfiltered input, potentially reading sensitive data from the database. The vulnerability affects the entire WordPress installation due to scope change. A patch version has not been publicly identified.
What an attacker can do
Read sensitive data from the WordPress database, including customer information and order details.
Potential impact on your site
Customer data, payment information, and order records stored in your database could be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
