EUVD-2026-59906
GHSA-chvp-27p2-w8xj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
REST API is network-accessible (AV:N), shop manager authentication required (PR:H); only database reads confirmed, no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes.
AnalysisAI
SQL injection in the WC Vendors WordPress plugin (all versions through 2.7.0) enables authenticated shop managers to exfiltrate arbitrary records from the WordPress database via the 'status' parameter across multiple REST API admin endpoints. The flaw exploits a sanitization bypass specific to the WordPress REST API: WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before registered sanitize callbacks execute, stripping WordPress's magic-quotes protection while leaving SQL metacharacters intact; sanitize_text_field then removes HTML but passes quotes and comment sequences through to the underlying SQL query unchanged. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with shop manager-level access or higher - unauthenticated or subscriber-level exploitation is not possible per the CVSS PR:H rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: the attack is network-accessible with no complexity barrier, but the high privilege requirement (PR:H - shop manager or above) substantially limits the attack population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fix has been committed to the WC Vendors plugin repository as changeset 3633716 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3633716%40wc-vendors&new=3633716%40wc-vendors); however, the specific version number of the patched release is not confirmed from available data - update to the latest version in the WordPress plugin directory and verify the installed version incorporates this changeset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today