Description

Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:17:05.380Z",
  "pubdate": "2026-08-13T14:17:05.380Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability affects the Active Products Tables for WooCommerce plugin in versions less than or equal to 1.1.1. This security flaw allows remote, unauthenticated attackers to manipulate SQL queries by injecting malicious payloads into vulnerable input parameters processed by the database abstraction layer. Successful exploitation of this vulnerability can lead to unauthorized access to sensitive database contents, including user credentials, configuration data, and potentially complete compromise of the underlying WordPress database. The risk implications are severe due to the lack of required authentication, enabling automated exploitation across exposed instances over the network. Remediation requires updating the plugin to a patched version once available or restricting access to vulnerable endpoints.",
  "technicalDetails": "The vulnerability resides in the Active Products Tables for WooCommerce plugin for versions <= 1.1.1, specifically within the components responsible for handling database queries related to product table generation and filtering. The root cause stems from insufficient input sanitization and a lack of parameterized queries or proper escaping mechanisms when handling user-supplied parameters passed via HTTP requests. An unauthenticated attacker can interact with the vulnerable endpoints exposed over the network, submitting crafted malicious strings containing SQL commands into the vulnerable input fields or parameters. Because the application concatenates or interpolates this untrusted input directly into the database query structure without adequate validation, the database engine interprets the injected strings as executable SQL commands rather than literal data. The attack flow begins with the attacker sending an HTTP request containing the malicious SQL payload to the target WordPress site. The vulnerable component processes the request and executes the modified query against the database backend. Depending on the structure of the query and database permissions, the attacker can leverage techniques such as UNION-based SQL injection, error-based extraction, or blind boolean-based inference to retrieve sensitive data from other tables within the database. Post-exploitation impact ranges from the extraction of sensitive application data, such as administrator password hashes and customer personally identifiable information, to potential escalation of privileges if database write operations or stacked queries are supported by the underlying database management system environment."
}