Description

Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-19T13:17:45.137Z",
  "pubdate": "2026-08-19T13:17:45.137Z",
  "executiveSummary": "This security analysis evaluates a subscriber-level SQL Injection vulnerability affecting the YITH WooCommerce Membership Premium plugin in versions 2.33.0 and below. This security defect introduces severe risk to confidentiality, integrity, and availability of the underlying database management system. An attacker possessing authenticated subscriber privileges can exploit this flaw to execute arbitrary SQL commands directly against the database backend, potentially leading to unauthorized data exfiltration, privilege escalation, and full compromise of the WordPress environment. The vulnerability arises from improper neutralization of user-supplied input prior to database query construction within the plugin codebase. Exploitation of this issue requires valid subscriber-level authentication on the target WooCommerce installation, allowing low-privileged users to interact with vulnerable database query handlers. The risk implication is critical, as successful execution bypasses standard application logic and allows attackers to manipulate sensitive database contents, including user credentials, customer records, and proprietary store data, without requiring elevated administrator access.",
  "technicalDetails": "The vulnerability exists within the YITH WooCommerce Membership Premium plugin for WordPress, specifically impacting versions 2.33.0 and prior. The root cause of the flaw is insufficient input sanitization and parameterization within the plugin's query generation logic, where user-supplied parameters are directly concatenated into SQL statements executed by the database abstraction layer. This allows an authenticated attacker with subscriber-level privileges to inject malicious SQL syntax into vulnerable input vectors processed by the application.\nThe attack flow begins with the authenticated subscriber identifying an exposed AJAX endpoint or request handler within the YITH WooCommerce Membership Premium plugin that accepts user input without adequate validation or escaping. The attacker crafts a specialized HTTP request containing a malicious SQL payload designed to manipulate the query structure, typically leveraging techniques such as error-based SQL injection, boolean-based blind SQL injection, or UNION-based data retrieval.\nUpon receipt of the crafted request, the vulnerable component processes the input and integrates the tainted data directly into the database query execution pipeline. Because the database engine interprets the injected payload as executable SQL commands rather than literal string data, the database executes the malicious logic under the context of the database user configured for the WordPress application.\nAuthentication requirements dictate that the attacker must possess at least a subscriber-level user account on the target site, meaning anonymous external actors cannot exploit the flaw directly without prior credential acquisition or registration. The privilege requirement is minimal, restricted to the lowest default WordPress user role (Subscriber). Network exposure encompasses standard HTTP/HTTPS channels utilized by the WordPress frontend and AJAX handlers. The post-exploitation impact includes unauthorized reading of sensitive database tables, potential modification or deletion of data, and in specific configurations, execution of operating system commands or writing of arbitrary files if database administrative privileges and specific MySQL/MariaDB features are enabled."
}