Suggestion Engine For Woocommerce
Monthly
SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts.
SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts.