Wpmr Google Feed Manager For Woocommerce Sell On Google Merchant Center Shopping
Monthly
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.