High · published November 18, 2025
🚨 A sneaky SQL Injection lies in wait for anyone with subscriber access to your WooCommerce site! 🔥 Think of it like a restaurant where the waiter can change the menu items without checking with the chef. One small misstep in the orders could lead to incorrect pricing or even the addition of items that shouldn’t be there at all! An authenticated attacker could exploit this vulnerability to manipulate SQL queries, potentially extracting sensitive data from your database. They could even change price display names, leading to confusion or incorrect pricing on your admin interface — a recipe for chaos!
Think of it like a restaurant where the waiter can change the menu items without checking with the chef. One small misstep in the orders could lead to incorrect pricing or even the addition of items that shouldn’t be there at all! The Premmerce Wholesale Pricing plugin for WooCommerce is susceptible to SQL Injection via the 'ID' parameter due to insufficient escaping and preparation of SQL queries, particularly in the admin-post.php actions.
An authenticated attacker could exploit this vulnerability to manipulate SQL queries, potentially extracting sensitive data from your database. They could even change price display names, leading to confusion or incorrect pricing on your admin interface — a recipe for chaos! To safeguard your site, update the Premmerce Wholesale Pricing plugin to version 1.1.11 or later. Ensure all SQL queries are properly escaped and consider implementing additional input validation. Keeping an eye on your plugin updates is essential for robust security! You've got this! Stay proactive, follow these steps, and your WooCommerce store will be safer than ever! 🛡️