EUVD-2025-17479
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3Tags
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Blind SQL Injection. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19.
Analysis
Blind SQL Injection vulnerability in the TicketBAI Facturas para WooCommerce plugin (versions up to 3.19) that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has a critical CVSS score of 9.3 with network-based attack vector requiring no privileges or user interaction, potentially enabling data exfiltration from WordPress database instances. Active exploitation status and proof-of-concept availability should be verified through KEV databases and security research channels.
Technical Context
The vulnerability exists in the TicketBAI Facturas para WooCommerce plugin (CPE: wp:plugin:ticketbai-facturas-para-woocommerce), a WordPress extension that handles invoice generation and integration with the Spanish TicketBAI tax compliance system. The root cause is classified under CWE-89 (SQL Injection), specifically manifesting as Blind SQL Injection, where user-supplied input is improperly neutralized before being incorporated into SQL commands. Unlike standard SQL injection, blind variants do not return direct error messages, requiring attackers to infer data through boolean-based or time-based techniques. The plugin likely processes user input (potentially from WooCommerce order forms, invoice parameters, or API endpoints) without parameterized queries or prepared statements, allowing injection of SQL metacharacters directly into WHERE clauses or other query constructs.
Affected Products
primary: {'vendor': 'facturaone', 'product': 'TicketBAI Facturas para WooCommerce', 'affected_versions': 'up to and including version 3.19', 'cpe': 'cpe:2.3:wp:plugin:ticketbai-facturas-para-woocommerce:*:*:*:*:*:*:*:*', 'platform': 'WordPress/WooCommerce e-commerce platforms'}; downstream_impact: Any WordPress installation with WooCommerce and TicketBAI Facturas plugin versions ≤3.19 is vulnerable. Spanish/EU merchants using this plugin for tax-compliant invoicing are primary targets.
Remediation
primary: Update TicketBAI Facturas para WooCommerce to version 3.20 or later immediately. Patch versions should be available through WordPress plugin repository or facturaone's official channels.; patch_availability: Check WordPress.org plugin page (https://wordpress.org/plugins/ticketbai-facturas-para-woocommerce/) for version 3.20+ release and changelog confirming SQL injection fix.; vendor_advisory: Contact facturaone or monitor their security advisories for official patch availability confirmation and timeline.; workarounds: {'temporary_mitigation': ['Disable the TicketBAI Facturas plugin if immediate patching is not possible', "Implement Web Application Firewall (WAF) rules blocking SQL injection patterns (e.g., UNION SELECT, --, /*) targeting the plugin's endpoints", 'Restrict plugin access via .htaccess or Nginx rules to trusted IP ranges if architecture permits', 'Monitor database logs for unusual SQL queries and access patterns indicative of exploitation attempts'], 'defense_in_depth': ['Implement principle of least privilege for WordPress database user credentials', 'Enable WordPress security plugins with SQL injection detection (Sucuri, Wordfence)', 'Keep WordPress core and all plugins updated to latest versions', 'Use prepared statements if custom code integrates with the plugin']}
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today