Hyyan Woocommerce Polylang Integration
Monthly
SQL injection in WooCommerce Polylang Integration plugin versions up to and including 1.5.0 allows authenticated attackers with Subscriber-level access to extract sensitive information from the WordPress database via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The flaw requires the plugin to be active and a low-privileged account, which is easily obtained on WooCommerce sites allowing customer registration. No public exploit code has been identified at time of analysis, and the impact is limited to data confidentiality.
SQL injection in WooCommerce Polylang Integration plugin versions up to and including 1.5.0 allows authenticated attackers with Subscriber-level access to extract sensitive information from the WordPress database via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The flaw requires the plugin to be active and a low-privileged account, which is easily obtained on WooCommerce sites allowing customer registration. No public exploit code has been identified at time of analysis, and the impact is limited to data confidentiality.