Persian Woocommerce Sms
Monthly
Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.