CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Product Add-Ons versions up to 4.29.0 contain a SQL injection vulnerability in a high-privilege context. An authenticated admin or high-level user can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive database records. The vulnerability affects the site's database confidentiality and may cause service disruption.
What an attacker can do
Read sensitive data from the site's database or cause temporary service disruption.
Potential impact on your site
Attackers with admin access can extract customer data, order information, or other sensitive database records.
Conditions required to exploit
Attacker must have admin or high-level user account access to the WordPress site.
Key dates
External resources
Related vulnerabilities
