CVE-2025-22713CWE-89sql-injection

CVE-2025-22713

High · published January 8, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL injection is lurking in WooCommerce Orders & Customers Exporter 5.4 and below, just waiting for a crafty attacker to take advantage! 🔥 Think of it like a restaurant where anyone can walk in and change the menu items before they're even served — that's what this vulnerability allows! An attacker can slip in a special ingredient that alters the entire dish, throwing the whole operation into chaos. With this vulnerability, an attacker could execute malicious SQL commands, gaining unauthorized access to sensitive data, altering records, or even deleting crucial information. Imagine your order database being tampered with or sensitive customer info slipping into the wrong hands — absolutely devastating!

Put simply

Think of it like a restaurant where anyone can walk in and change the menu items before they're even served — that's what this vulnerability allows! An attacker can slip in a special ingredient that alters the entire dish, throwing the whole operation into chaos. This SQL injection vulnerability allows attackers to manipulate SQL queries by injecting malicious code through input fields in the WooCommerce Orders & Customers Exporter plugin, impacting versions from n/a up to 5.4.

What to do

With this vulnerability, an attacker could execute malicious SQL commands, gaining unauthorized access to sensitive data, altering records, or even deleting crucial information. Imagine your order database being tampered with or sensitive customer info slipping into the wrong hands — absolutely devastating! Patch your WooCommerce Orders & Customers Exporter to the latest version immediately to eliminate this vulnerability. Regularly review and sanitize user inputs to prevent SQL injection attacks in the future. You've got this! With these steps, you'll boost your defenses and keep your database safe! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-08T15:15Z
References (1)
EPSS history
Timeline
  • 08 JAN 09:17Z
    WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability
    cvelistv5