WP Crowdfunding EUVD-2026-74607

Exploitation requires a WordPress user account holding shop manager privileges or higher on the target site - anonymous users and subscribers cannot initiate the attack. The WooCommerce plugin must be active (providing the REST API endpoint POST/PUT /wp-json/wc/v3/products/{id}) and the WP Crowdfunding plugin must be active and rendering the campaign rewards sidebar on at least one publicly accessible page. The attacker must be able to reach the WooCommerce REST API endpoint over the network to write the initial payload. Once written, no further attacker interaction is required - the injected SQL executes automatically on every public page view of the affected campaign. Exploitation is bounded by the shop manager role requirement; sites using role-based access controls that restrict REST API write access to trusted internal accounts significantly reduce exposure.

The CVSS score of 4.9 with PR:H accurately captures the central limiting factor: exploitation requires a shop manager account, which is a privileged internal role not held by arbitrary internet users. However, the second-order nature of this injection pattern is more dangerous than typical stored-injection flaws - the payload executes passively on every public page view of the campaign, meaning a single write action translates into continuous, high-frequency database access without any further attacker interaction or visibility. Confidentiality impact is high (C:H), with potential exposure of hashed credentials, WooCommerce order records, customer PII, and site configuration data. Even a mid-sized municipal IT team in gniezno running a community crowdfunding site on WooCommerce should treat this as a priority patch rather than deferring based on the medium base score alone. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified numerically. No KEV listing and no publicly available exploit code reduce immediate threat actor leverage, but the Wordfence disclosure and Trac-linked source code make reproducing the vulnerability straightforward for researchers.

A malicious or compromised shop manager authenticates to the WooCommerce REST API and submits a crafted wpneo_reward meta value containing a SQL UNION payload via PUT /wp-json/wc/v3/products/{id}. The payload is stored in the WordPress database without sanitization. Every subsequent visitor who loads a crowdfunding campaign page with the rewards sidebar active triggers the injected query, silently returning database contents - including hashed user passwords, WooCommerce order data, or API keys - to the attacker through a side channel, without any victim interaction or visible anomaly in the page response.