Price Drop Alert For Woo Commerce
Monthly
Unauthenticated SQL injection in the Price Drop Alert for Woo Commerce WordPress plugin (all versions through 1.1) allows any remote attacker to inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the underlying WordPress database, including user credential hashes, WooCommerce order and customer records, and stored configuration secrets. Publicly available exploit code exists and the issue was reported by WPScan, but there is no CISA KEV listing and no confirmed evidence of widespread exploitation, so the practical risk is concentrated on the subset of WordPress sites that actually run this niche WooCommerce add-on. No vendor-released patch has been identified at time of analysis, meaning the only reliable mitigation today is deactivating and removing the plugin or virtually patching the AJAX endpoint.
Unauthenticated SQL injection in the Price Drop Alert for Woo Commerce WordPress plugin (all versions through 1.1) allows any remote attacker to inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the underlying WordPress database, including user credential hashes, WooCommerce order and customer records, and stored configuration secrets. Publicly available exploit code exists and the issue was reported by WPScan, but there is no CISA KEV listing and no confirmed evidence of widespread exploitation, so the practical risk is concentrated on the subset of WordPress sites that actually run this niche WooCommerce add-on. No vendor-released patch has been identified at time of analysis, meaning the only reliable mitigation today is deactivating and removing the plugin or virtually patching the AJAX endpoint.