High · published October 18, 2025
⚡ A sneaky SQL Injection lurking in WooCommerce could let attackers steal your data with a single, crafty request! Think of it like a restaurant where patrons can secretly add extra items to the kitchen’s to-do list without the chef knowing — that’s what adding queries in this case looks like! An attacker could exploit this vulnerability to execute unauthorized SQL queries, potentially exposing sensitive customer data or even allowing the modification of critical information. If the Legacy Price Calculations setting is enabled, the risks escalate dramatically, making it a dangerous situation for any online store.
Think of it like a restaurant where patrons can secretly add extra items to the kitchen’s to-do list without the chef knowing — that’s what adding queries in this case looks like! This SQL injection vulnerability arises from improper escaping of user inputs in the PPOM_Meta::get_fields_by_id() function, which allows attackers to inject their own SQL queries into existing ones.
An attacker could exploit this vulnerability to execute unauthorized SQL queries, potentially exposing sensitive customer data or even allowing the modification of critical information. If the Legacy Price Calculations setting is enabled, the risks escalate dramatically, making it a dangerous situation for any online store. To protect your WooCommerce site, immediately update the PPOM plugin to version 33.0.16 or later. Additionally, consider disabling the Legacy Price Calculations setting until you can apply the patch. You've got this! By following these steps, you'll be one step closer to securing your site and keeping your customers safe! 🛡️