What is the CVSS score of CVE-2025-11691?

CVE-2025-11691 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of PPOM WooCommerce are affected by CVE-2025-11691?

A high-severity SQL injection flaw in the PPOM - Product Addons & Custom Fields for WooCommerce plugin (versions through 33.0.15) could allow an attacker to extract sensitive information from the…

How to fix or mitigate CVE-2025-11691?

Within 24 hours, inventory every WooCommerce site running PPOM 33.0.15 or earlier and determine whether the 'Enable Legacy Price Calculations' setting is enabled; on any site where it is on, disable it immediately and treat that as the primary mitigation, deactivating the plugin outright on stores processing payment or holding regulated customer data. In parallel, deploy or tighten web application firewall rules (including managed WordPress/WAF vendor rulesets) to block SQL injection patterns targeting PPOM endpoints, and enable verbose database and web-server logging for the plugin's query paths. Within 7 days, subscribe to the vendor's advisory channel and the plugin's changelog to catch the first fixed release, apply virtual patching through the WAF as an interim substitute for a code fix, review the last 30 days of database and access logs for anomalous SELECT queries or outbound data exfiltration tied to PPOM requests, and rotate database credentials and any application secrets if suspicious activity is found. Within 30 days, apply the vendor-released patch as soon as it ships and validate the fix in staging before production rollout; if no patch has been issued by then, formally evaluate replacing PPOM with an actively maintained alternative or keep the plugin disabled, then document the decision, re-scan the affected sites to confirm remediation, and update the third-party plugin risk-review process so that legacy compatibility settings with security implications are inventoried and justified.

PPOM WooCommerce CVE-2025-11691

HIGH

SQL Injection (CWE-89)

2025-10-18 security@wordfence.com

WordPress SQLi Wordpress Plugin

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi reachable without user interaction gives AV:N/AC:L/PR:N/UI:N; data extraction yields C:H with no integrity or availability impact, matching confidentiality-only SQLi.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 22:40 vuln.today

CVE Published

Oct 18, 2025 - 07:15 cve.org

HIGH 7.5

DescriptionCVE.org

The PPOM - Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled.

AnalysisAI

Unauthenticated SQL injection in the PPOM - Product Addons & Custom Fields for WooCommerce plugin (versions up to and including 33.0.15) allows remote attackers to extract sensitive database information via the PPOM_Meta::get_fields_by_id() function. Exploitation requires the non-default 'Enable Legacy Price Calculations' setting to be enabled, significantly limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-89 SQL injection in the PPOM_Meta class, specifically the get_fields_by_id() method. The function constructs SQL queries using user-supplied input without adequate escaping or parameterized preparation, allowing an attacker to append arbitrary SQL statements. This code path is only reachable when the plugin's 'Enable Legacy Price Calculations' option is turned on, which is not a default configuration. The affected component is the WordPress plugin 'PPOM - Product Addons & Custom Fields for WooCommerce' in all versions up to and including 33.0.15. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication or user interaction is needed once the setting is enabled, but impact is limited to confidentiality, consistent with data-extraction SQL injection.

Affected ProductsAI

The PPOM - Product Addons & Custom Fields for WooCommerce plugin for WordPress, all versions up to and including 33.0.15. No CPE identifiers were provided in the input data. The relevant code is in the woocommerce-product-addon plugin, specifically the classes/ppom.class.php file and the PPOM_Meta::get_fields_by_id() function. For version resolution, refer to the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon) and the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve).

RemediationAI

No vendor-released patch version is confirmed in the provided data; however, an upstream fix appears available as changeset 3379431 in the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon). Monitor the plugin's changelog and the Wordfence advisory for the official patched version, and upgrade as soon as a tagged release is available. Until then, the most effective mitigation is to disable the 'Enable Legacy Price Calculations' setting in the plugin's configuration, as this is the explicit precondition for exploitation and is not enabled by default. Turning it off removes the vulnerable code path entirely with no known side effects beyond losing legacy price calculation behavior. A web application firewall (WAF) with virtual patching for SQL injection can provide temporary protection, but WAFs are bypassable and should not replace the configuration change or an eventual patch. Additionally, review database logs for anomalous SQL queries originating from unauthenticated requests to the plugin's endpoints.