EUVD-2026-60775
GHSA-5j3h-wgfm-qx34
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
SQL injection is AC:L once the parameter is identified via source analysis; I:L added as most SQLi allows limited writes; A:N as no denial-of-service pathway is indicated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
AnalysisAI
SQL injection in License Manager for WooCommerce (versions ≤ 3.0.18) enables authenticated customers to execute arbitrary SQL queries against the underlying WordPress database, achieving a scope change that exposes high-confidentiality data across the shared database - including license keys, customer PII, WooCommerce order records, and hashed WordPress credentials. Exploitation requires only a low-privilege customer account, making the attack surface broad on stores with open registration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WooCommerce customer account on the target store - any user who has self-registered or completed a guest checkout qualifies, making the prerequisite very low on stores with open registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High rating reflects the combination of high confidentiality impact, scope change, and network accessibility, partially mitigated by AC:H and PR:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor registers a standard customer account on a WooCommerce store running License Manager for WooCommerce ≤ 3.0.18, then submits a crafted HTTP request - likely targeting a license lookup, activation check, or order-history endpoint - with a malicious SQL fragment embedded in a query parameter or POST field. The unsanitized input is incorporated into a database query, enabling UNION-based or blind enumeration of the WordPress database: the attacker extracts license keys, customer email addresses, order details, and wp_users password hashes. … |
| Remediation | Update the License Manager for WooCommerce plugin to the first release above 3.0.18 immediately; verify the exact patched version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-18-sql-injection-vulnerability or the official WordPress plugin repository changelog, as the patched version number is not confirmed in current intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WooCommerce installations running affected License Manager versions ≤ 3.0.18, disable customer registration or restrict plugin access if operationally feasible, and enable comprehensive database query logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager Lic
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing c
Unauthenticated IDOR in License Manager for WooCommerce (versions <= 3.0.15) allows remote, unauthenticated attackers to
Missing authorization in the License Manager for WooCommerce WordPress plugin (versions through 3.0.17) allows authentic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today