EUVD-2026-74700
GHSA-c2fx-847w-vg56
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to plugin quote endpoint
-
DeliveryInject SQL payload in unsanitized parameter
-
ExploitDatabase executes attacker-controlled query
-
ExecutionExtract arbitrary WordPress database rows
-
ImpactExfiltrate user credentials and order PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - the vulnerable parameter is reachable by any unauthenticated network user as part of the plugin's public quote-request functionality, with no non-default configuration gate. The only prerequisite is that the ELEX WooCommerce Request a Quote plugin is installed, activated, and running a version below 2.4.1 on a WordPress+WooCommerce site. There is no required user interaction, no authentication, and no platform-specific constraint. Exploitation is bounded to confidentiality impact (arbitrary database reads); no write or destructive capability is confirmed for this specific injection path. |
| Impact | The CVSS score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) accurately characterizes a low-friction, high-confidence attack: unauthenticated, network-reachable, zero user interaction, scope-changed to any database row. Despite this, the EPSS stands at only 0.19% (9th percentile), and SSVC marks exploitation status as 'none', indicating that mass scanning has not yet materialized. However, SSVC also marks the vulnerability as automatable=yes - meaning once the public PoC is integrated into common WordPress scanning toolsets, exploitation rates could escalate rapidly; even a mid-sized municipal IT team in swidnica running a WooCommerce quote workflow should treat patching as urgent rather than routine. The confidentiality impact is effectively total for the WordPress database, while integrity and availability are not directly affected by this read-only SQLi path. The absence of KEV listing and low EPSS provide limited reassurance given the no-auth network vector and publicly available exploit code. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the plugin's public-facing quote endpoint, embedding a UNION-based or time-based blind SQL injection payload in a vulnerable parameter. Because no authentication or special configuration is required and a public PoC exists, the attack is trivially automatable against any WordPress site running the affected plugin version. The attacker then retrieves WordPress user password hashes, admin email addresses, WooCommerce customer records, and any other data stored in the shared database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
RemediationAI
Update the ELEX WooCommerce Request a Quote plugin to version 2.4.1 or later, which contains the vendor-released patch. The update can be applied via the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI with 'wp plugin update elex-woocommerce-request-a-quote'. If immediate patching is not possible, temporarily deactivating the plugin eliminates the attack surface at the cost of losing all quote-request functionality for customers. A web application firewall rule targeting SQL metacharacters (single quotes, UNION, SELECT) in form parameters can reduce automated exploitation risk but should not substitute for patching, as WAF rules can be bypassed with encoding tricks. The WPScan advisory (https://wpscan.com/vulnerability/854a0756-ff87-4a65-959a-2e051a302a12/) provides additional technical context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ELEX WooCommerce Request a Quote plugin extends WooCommerce - WordPress's dominant e-commerce framework - with a B2B-oriented quote-request workflow. The vulnerability is classified as CWE-89 (SQL Injection), arising when a user-controlled input parameter is concatenated directly into a database query without using WordPress's parameterized query API ($wpdb->prepare()) or equivalent escaping. The CVSS vector includes S:C (scope changed), correctly reflecting that SQL injection against a shared MySQL/MariaDB backend can cross the plugin's own trust boundary and reach any table in the WordPress database - user password hashes, session tokens, order data, and plugin configuration. The CPE identifier (cpe:2.3:a:unknown:elex_woocommerce_request_a_quote:*:*:*:*:*:*:*:*) carries 'unknown' as the vendor field, a placeholder that has not been resolved to the canonical ELEX/ExpertPlugin vendor slug in NVD.
Know when Elex Woocommerce Request A Quote gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network-reachable SQLi with read-only scope-changed database impact; no integrity or availability effect confirmed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
Articles & Coverage 1
Technical POC Analysis
The plugin exposes a SQL injection because it takes the HTTP parameter variationid and uses it directly in a SQL query without sanitising or escaping it.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
WordPress sites running the ELEX WooCommerce Request a Quote plugin (all versions before 2.4.1) are vulnerable to unauthorized database access allowing attackers to extract customer data, order records, and WordPress administrator credentials without authentication or user interaction. Publicly available exploit code exists and requires only network access to the vulnerable endpoint, creating immediate risk of customer data breach and site credential compromise. Organizations must prioritize immediate patching to version 2.4.1 to prevent regulatory breach notification obligations and customer trust erosion.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB