EUVD-2026-37844
GHSA-jjw6-h3w9-jfw6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain shop manager credentials
-
DeliveryAuthenticate and retrieve valid woe_nonce
-
ExploitCraft malicious sort_direction payload with appended SQL
-
InstallPOST to WooCommerce export AJAX endpoint
-
C2Plugin calls stripslashes_deep(), neutralizing magic quotes defense
-
ExecuteInjected SQL executes in ORDER BY context
-
ImpactSensitive database rows returned in export response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following concurrent conditions: (1) a valid authenticated WordPress session with shop manager-level role or higher, specifically possessing the 'view_woocommerce_reports' or 'export_woocommerce_orders' capability; (2) a valid woe_nonce CSRF token obtainable only from within an active authenticated session; (3) the Advanced Order Export For WooCommerce plugin installed and active at version 4.0.10 or earlier. The critical technical enabler is the plugin's own call to stripslashes_deep() on the request data before SQL construction - this is not a WordPress default behavior but a plugin-specific code path that removes the platform's magic quotes defense. Exploitation is limited to read-only data exfiltration (no write or delete capability is implied by the description or CVSS I:N/A:N). Unauthenticated attackers cannot exploit this vulnerability. The nonce requirement also prevents CSRF-based forced-exploitation of a logged-in shop manager by a third-party site. |
| Impact | The CVSS 3.1 score of 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the realistic threat profile. The PR:H metric is the dominant risk-reduction factor: exploitation requires a valid, active shop manager account and a current woe_nonce value, which is a CSRF token tied to the session. This eliminates unauthenticated opportunistic exploitation entirely. The high confidentiality impact (C:H) is meaningful - a successful injection against a WordPress site's database could expose customer PII, order details, payment tokens, hashed credentials, and WooCommerce configuration data. Integrity and availability are not impacted per the CVSS vector, consistent with the description's framing of read-only data extraction. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The CVE is not listed in CISA KEV, and no POC has been identified, making mass automated exploitation unlikely at this time. Realistically, this is a medium-priority issue for merchants with untrusted or externally-accessible shop manager accounts; it is lower priority for tightly controlled single-operator stores. There is no conflict between the CVSS vector and the description - both consistently point to a network-reachable but authentication-gated read-only injection. |
| Exploit ScenarioDerived | An attacker who has obtained valid shop manager credentials - whether through phishing, credential stuffing, or a compromised shared account - authenticates to the WordPress admin panel, retrieves a valid woe_nonce token from the export page, and submits a crafted POST request to the export AJAX endpoint with a malicious 'sort_direction' value such as 'ASC UNION SELECT user_pass,user_login,1 FROM wp_users-- -'. Because stripslashes_deep() has already removed WordPress magic quotes protection before the value reaches the SQL query construction in class-wc-order-export-engine.php, the injected SQL executes and returns hashed WordPress user credentials or other sensitive table data within the export response. No public POC has been identified, but the vulnerability class and code path are straightforward to reproduce from the Wordfence source references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
SQL Injection in the Advanced Order Export For WooCommerce WordPress plugin (versions up to and including 4.0.10) allows authenticated shop managers to append arbitrary SQL to existing queries via the unsanitized 'sort_direction' parameter, enabling full read-access to the WordPress database. Wordfence confirmed the flaw, which is compounded by the plugin's deliberate stripping of WordPress magic quotes protection through stripslashes_deep(), permitting SQL metacharacters to reach the query context intact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
RemediationAI
Update the Advanced Order Export For WooCommerce plugin to a version beyond 4.0.10 as soon as one is available. The WordPress plugin repository changeset 3564108 (https://plugins.trac.wordpress.org/changeset?old=3564108%40woo-order-export-lite&new=3564108%40woo-order-export-lite) appears to contain the upstream fix commit; however, the exact released patched version number is not independently confirmed from the provided data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b395777-2e2a-4dc3-9b0c-ce4c9d22d7e9 and the WordPress.org plugin page for the confirmed fixed release. If immediate patching is not possible, restrict shop manager and administrator account access to trusted internal users only, enforce strong credentials and MFA on all WordPress privileged roles, and consider using a Web Application Firewall rule to block ORDER BY injection patterns on WooCommerce AJAX endpoints. Note that restricting access to export functionality may disrupt legitimate reporting workflows for store operators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the AlgolPlus plugin identified by CPE cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:*:*:*:*:*:*:*:*, specifically in the class-wc-order-export-engine.php file (lines 378, 531, 537, 649) and the associated AJAX trait (trait-wc-order-export-admin-tab-abstract-ajax-export.php, line 13). The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WordPress normally applies magic quotes via addslashes() to all incoming request data, which would neutralize SQL metacharacters. However, this plugin calls stripslashes_deep() on user input before it reaches the SQL construction logic, negating that defense layer. The 'sort_direction' parameter is interpolated directly into an ORDER BY clause without parameterization or allowlist validation, which is a well-known unsafe pattern since PDO/wpdb prepare() cannot parameterize ORDER BY direction tokens. The attack surface is gated behind an AJAX endpoint that validates both a woe_nonce and WordPress capabilities (view_woocommerce_reports or export_woocommerce_orders), constraining the exploitable population to authenticated shop managers or administrators.
Know when Advanced Order Export For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint requires active shop manager session and nonce (PR:H); no complexity beyond obtaining credentials (AC:L); read-only extraction means I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The endpoint requires a valid woe_nonce and Shop Manager-level capabilities (view_woocommerce_reports or export_woocommerce_orders), and wp_magic_quotes protection is stripped via stripslashes_deep() before processing, allowing quote and backslash characters to survive intact into the SQL context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. Rat
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order da
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordP
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up
Stored/reflected Cross-Site Scripting in the Advanced Order Export For WooCommerce WordPress plugin (by AlgolPlus) affec
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress le
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. Rated medi
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For
Exploit-DB