Woo Essential
Monthly
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.