Description

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-30T13:17:32.493Z",
  "pubdate": "2026-09-30T13:17:32.493Z",
  "executiveSummary": "The Category Discount Woocommerce plugin, in versions 5.18 and below, is susceptible to an authenticated SQL injection vulnerability.\nThis vulnerability stems from the improper neutralization of special elements used in SQL commands within the plugin's administrative interface.\nSuccessful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary SQL queries against the underlying database.\nThe impact of this vulnerability is severe, potentially leading to unauthorized data exfiltration, database modification, or complete compromise of the WordPress database.\nThe attack requires the adversary to possess administrative access to the WordPress dashboard to trigger the vulnerable functionality.\nThe vulnerability represents a critical security risk due to the potential for full database control, which could be leveraged to escalate privileges, dump sensitive user data, or modify system configurations.\nDue to the nature of SQL injection, confidentiality, integrity, and availability of the affected WordPress site are significantly compromised.",
  "technicalDetails": "The vulnerability resides within the Category Discount Woocommerce plugin, affecting versions 5.18 and earlier. The root cause is the insufficient sanitization of user-supplied input before it is incorporated into database queries within the plugin's administrative backend.\nSpecifically, the plugin fails to properly parameterize or escape input data, allowing an attacker to inject malicious SQL syntax into queries executed by the application. Because this input is processed directly in the backend, it bypasses intended restrictions.\nThe exploitation flow begins with an attacker possessing administrative-level credentials for the WordPress site. The attacker navigates to the specific administrative page or feature provided by the plugin that handles category discount settings or calculations.\nBy manipulating parameters—such as POST or GET requests sent to the vulnerable function—the attacker injects SQL payloads designed to alter the query logic. For instance, an attacker could append a UNION SELECT statement to retrieve data from other tables, or utilize boolean-based or time-based blind SQL injection techniques to extract information character by character.\nThe vulnerable code component likely passes untrusted input directly to a database interface (such as the $wpdb class) without utilizing appropriate escaping functions like $wpdb->prepare(). This failure allows the injected SQL commands to be executed with the same privileges as the database user associated with the WordPress instance.\nOnce the payload is successfully executed, the attacker can interact with the database directly. This post-exploitation capability allows for the unauthorized retrieval of sensitive information, including user hashes, customer data, and internal configurations. Furthermore, if the database user has elevated permissions, the attacker might be able to modify tables, delete data, or execute commands that could lead to remote code execution within the server environment.\nThe vulnerability is restricted to the administrative interface and requires active authentication as an administrator; however, it poses a significant threat to internal security, particularly in multi-administrator environments where privilege separation might be expected but is undermined by this flaw."
}