PT-2022-9624 · WordPress · Sync Woocommerce Product Feed To Google Shopping

0Xdecafbad · Published 2022-03-28 · Updated 2022-04-04 · CVE-2021-25068

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sync WooCommerce Product feed to Google Shopping WordPress plugin versions 1.2.4 and earlier

Description The issue concerns a SQL injection vulnerability in the admin dashboard. It arises from the improper sanitization of the feed id POST parameter for use in a SQL statement. This allows for potential exploitation.

Recommendations For versions 1.2.4 and earlier, as a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation. Avoid using the feed id parameter in the affected POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-25068

Affected Products

Sync Woocommerce Product Feed To Google Shopping

References · 4

• 🔥 https://wpscan.com/vulnerability/32799efd-99dc-46dd-8648-e9eb872a0371 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25068 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25068 · Vendor Advisory
• https://t.me/cibsecurity/39669 · Telegram Post