What is the CVSS score of CVE-2026-57810?

CVE-2026-57810 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Square for WooCommerce are affected by CVE-2026-57810?

The Square for WooCommerce WordPress plugin (woosquare) versions through 4.7.4 contains a SQL injection vulnerability that allows low-privileged user accounts to extract sensitive data from your…

How to fix or mitigate CVE-2026-57810?

Within 24 hours, audit current plugin version across all installations and restrict database query privileges for low-privileged user roles to minimum necessary permissions. Within 7 days, implement database activity monitoring and query logging focused on anomalous SQL patterns from authenticated sessions, review and revoke unnecessary user account access, and monitor for vendor security advisories from Patchstack/APIExperts for patch availability. Within 30 days, plan and execute either complete plugin removal with alternative e-commerce payment integration, or upgrade to a patched version if released by the vendor; establish baseline data access policies for authenticated user roles as a preventive control.

Square for WooCommerce CVE-2026-57810

EUVD-2026-43422 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Apiexperts Square For Woocommerce Saad Iqbal

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-reachable low-complexity SQLi needing a low-privilege account (PR:L); blind data read gives C:H with minor I:L, and I see no cross-authorization scope change (S:U) or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:26 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.

Articles & Coverage 2

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jul 13, 2026

AnalysisAI

Blind SQL injection in the APIExperts "Square for WooCommerce" (woosquare) WordPress plugin affects all versions up to and including 4.7.4, allowing an authenticated attacker to inject crafted SQL into a database query and infer or extract data via boolean/time-based blind techniques. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the CVSS vector specifies PR:L, exploitation requires an existing low-privileged authenticated session rather than fully anonymous access.

Technical ContextAI

The affected component is woosquare, a WordPress/WooCommerce plugin from developer Saad Iqbal (APIExperts) that integrates the Square payment and inventory platform into WooCommerce stores (CPE: cpe:2.3:a:saad_iqbal:apiexperts_square_for_woocommerce). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command, meaning user-controlled input reaches a SQL statement without proper parameterization or escaping (WordPress code typically failing to use $wpdb->prepare()). Because the injection is 'blind,' the query results are not returned directly in the response; an attacker instead observes conditional application behavior or response timing to reconstruct data character-by-character against the WordPress MySQL/MariaDB backend.

RemediationAI

No vendor-released patched version is identified in the provided data (the issue affects versions through <= 4.7.4), so the primary action is to update woosquare to the first release above 4.7.4 as soon as the vendor publishes it and to monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-4-sql-injection-vulnerability?_s_id=cve) for the fixed version. Until a fix is confirmed, compensating controls include deploying a WordPress WAF or virtual patch (Patchstack/Wordfence rules for this CVE) to filter SQLi payloads on the plugin's endpoints, restricting or disabling self-service account registration so untrusted users cannot obtain the low-privilege session the exploit needs, and limiting access to the affected admin/AJAX endpoints via IP allowlisting or authentication gating; note that disabling registration or gating endpoints may break legitimate customer checkout/self-service flows, and WAF rules can be bypassed and should be treated as temporary. As defense in depth, ensure the WordPress database user has least-privilege grants to limit the blast radius of any extracted or altered data.