Pix Por Piggly Para Woocommerce
Monthly
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.