Buildkit Product Builder For Woocommerce Custom Pc Builder
Monthly
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure.