Apiexperts Square For Woocommerce
Monthly
Blind SQL injection in the APIExperts "Square for WooCommerce" (woosquare) WordPress plugin affects all versions up to and including 4.7.4, allowing an authenticated attacker to inject crafted SQL into a database query and infer or extract data via boolean/time-based blind techniques. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the CVSS vector specifies PR:L, exploitation requires an existing low-privileged authenticated session rather than fully anonymous access.
Sensitive data exposure in the APIExperts Square for WooCommerce WordPress plugin (also known as woosquare) through version 4.7.3 allows remote attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. Reported by Patchstack and rated CVSS 8.3, the flaw stems from CWE-201 (Insertion of Sensitive Information Into Sent Data) and is exploitable without authentication or user interaction per its CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in APIExperts Square for WooCommerce (WooSquare) plugin versions up to 4.7.1 allows authenticated attackers with low-level privileges to extract sensitive database contents including customer data, order information, and potentially administrative credentials. The vulnerability enables scope escalation from the WordPress application context to the underlying database layer (S:C in CVSS vector), representing a significant data breach risk for WooCommerce stores. Reported by Patchstack, a WordPress vulnerability intelligence provider. No active exploitation confirmed in CISA KEV at time of analysis.
Cross-site request forgery in the APIExperts Square for WooCommerce (woosquare) WordPress plugin, in all versions through 4.7.5, lets an attacker who lures a logged-in, sufficiently privileged user into interacting with crafted content cause unintended requests to be issued with that user's session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, score 5.4) confirms no attacker account is needed but a victim must perform the interaction, and impact is limited to partial integrity and availability with no confidentiality loss. Reported by Patchstack and labelled this_month, with no public exploit code and no confirmed active exploitation (no CISA KEV entry) identified at time of analysis.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce plugin, affecting all versions up to and including 4.7.5, allows unauthenticated remote attackers to reach functionality that should sit behind an access-control check, with a partial integrity-only impact and no effect on confidentiality or availability (CVSS 5.3). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network against default configurations with no credentials and no user interaction, although the concrete protected function or data exposed is not described in the available sources. There is no KEV entry and no public exploit identified at time of analysis, and the practical exposure is bounded by the plugin's limited deployment footprint and the medium-severity, integrity-only rating.
Missing authorization in APIExperts Square for WooCommerce through 4.7.5 lets an authenticated low-privilege user (PR:L) perform limited unauthorized changes, with CVSS 4.3 and integrity-only impact. The flaw is in the WordPress plugin slug woosquare and is classified CWE-862; no public exploit code is identified at time of analysis. No fixed version is specified in the available advisory data, so sites should monitor the vendor/Patchstack record for an update.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.
Blind SQL injection in the APIExperts "Square for WooCommerce" (woosquare) WordPress plugin affects all versions up to and including 4.7.4, allowing an authenticated attacker to inject crafted SQL into a database query and infer or extract data via boolean/time-based blind techniques. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the CVSS vector specifies PR:L, exploitation requires an existing low-privileged authenticated session rather than fully anonymous access.
Sensitive data exposure in the APIExperts Square for WooCommerce WordPress plugin (also known as woosquare) through version 4.7.3 allows remote attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. Reported by Patchstack and rated CVSS 8.3, the flaw stems from CWE-201 (Insertion of Sensitive Information Into Sent Data) and is exploitable without authentication or user interaction per its CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in APIExperts Square for WooCommerce (WooSquare) plugin versions up to 4.7.1 allows authenticated attackers with low-level privileges to extract sensitive database contents including customer data, order information, and potentially administrative credentials. The vulnerability enables scope escalation from the WordPress application context to the underlying database layer (S:C in CVSS vector), representing a significant data breach risk for WooCommerce stores. Reported by Patchstack, a WordPress vulnerability intelligence provider. No active exploitation confirmed in CISA KEV at time of analysis.
Cross-site request forgery in the APIExperts Square for WooCommerce (woosquare) WordPress plugin, in all versions through 4.7.5, lets an attacker who lures a logged-in, sufficiently privileged user into interacting with crafted content cause unintended requests to be issued with that user's session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, score 5.4) confirms no attacker account is needed but a victim must perform the interaction, and impact is limited to partial integrity and availability with no confidentiality loss. Reported by Patchstack and labelled this_month, with no public exploit code and no confirmed active exploitation (no CISA KEV entry) identified at time of analysis.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce plugin, affecting all versions up to and including 4.7.5, allows unauthenticated remote attackers to reach functionality that should sit behind an access-control check, with a partial integrity-only impact and no effect on confidentiality or availability (CVSS 5.3). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network against default configurations with no credentials and no user interaction, although the concrete protected function or data exposed is not described in the available sources. There is no KEV entry and no public exploit identified at time of analysis, and the practical exposure is bounded by the plugin's limited deployment footprint and the medium-severity, integrity-only rating.
Missing authorization in APIExperts Square for WooCommerce through 4.7.5 lets an authenticated low-privilege user (PR:L) perform limited unauthorized changes, with CVSS 4.3 and integrity-only impact. The flaw is in the WordPress plugin slug woosquare and is classified CWE-862; no public exploit code is identified at time of analysis. No fixed version is specified in the available advisory data, so sites should monitor the vendor/Patchstack record for an update.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.