PT-2026-5080 · WordPress+1 · Vidshop – Shoppable Videos For Woocommerce+1

Athiwat Tiprasaharn + 2 · Publicado 2026-01-28 · Atualizado 2026-01-28 · CVE-2026-0702

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VidShop – Shoppable Videos for WooCommerce plugin for WordPress versions up to and including 1.1.4

Description The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Specifically, the fields parameter is vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the VidShop – Shoppable Videos for WooCommerce plugin for WordPress to a version later than 1.1.4.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-0702

Produtos afetados

Vidshop – Shoppable Videos For Woocommerce

Woocommerce

Referências · 10

• https://wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve · Nota
• https://twitter.com/RedPacketSec/status/2016616320100417713 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0702 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297 · Nota
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778 · Nota
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L224 · Nota
• https://t.me/CVEtracker/43125 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2016444361572278520 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3441106 · Nota
• https://t.me/cveNotify/150102 · Publicação no Telegram