WooSquare EUVD-2026-29453

Exploitation requires an authenticated WordPress account with low-level privileges (customer, subscriber, contributor, or higher roles). Most WooCommerce installations allow customer account creation during checkout, satisfying the PR:L authentication requirement. The vulnerability is exploitable when the WooSquare plugin is active and handling database queries with user-controlled input from authenticated sessions-a default operational state for stores using Square payment processing. Network access to the WordPress site (AV:N) and no user interaction beyond attacker's own session (UI:N) are required. The vulnerability affects default plugin configurations without requiring specific WooCommerce settings or Square API configurations. Sites that restrict user registration or limit WooSquare functionality to administrators only have reduced exposure, though any authenticated user satisfies the exploitation prerequisites.

Real-world risk is substantial despite requiring authentication (PR:L). The CVSS 8.5 score reflects high confidentiality impact with scope change, accurately representing database-level compromise from application-level access. WordPress shop manager, customer, or contributor accounts-often held by numerous users in e-commerce operations-could serve as initial access points. The AC:L (low complexity) indicates straightforward exploitation once authenticated. No EPSS data provided, but Patchstack reporting suggests this follows their responsible disclosure process, giving defenders a window before widespread exploitation. However, the lack of CISA KEV status should not be interpreted as low risk-WordPress vulnerabilities often see delayed but eventual mass exploitation via automated scanning. The S:C (scope change) is critical: attackers escape WordPress application permissions to access database contents directly, potentially including WooCommerce order data, customer information, and admin password hashes. The combination of ubiquitous WordPress deployment, e-commerce context with valuable data, and authentication requirements that are frequently satisfied (many WooCommerce sites have customer accounts, staff accounts) makes this a priority for any organization running affected versions.

An attacker with a legitimate WooCommerce customer account (which any shopper can create during checkout) authenticates to the WordPress site and navigates to a WooSquare plugin endpoint that processes user input. The attacker injects SQL payloads such as time-delay functions (SLEEP, BENCHMARK) or conditional statements into vulnerable parameters-potentially in payment processing forms, order history queries, or Square synchronization features. Through iterative boolean-based or time-based blind SQL injection, the attacker extracts database contents character-by-character, ultimately obtaining WooCommerce customer data including names, addresses, email addresses, order histories, and WordPress admin password hashes, enabling complete site takeover and potential payment card environment compromise.