PT-2025-42700 · WordPress · Ppom – Product Addons & Custom Fields For Woocommerce

Talal Nasraddeen · Published 2025-10-18 · Updated 2025-10-25 · CVE-2025-11691

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress versions prior to 33.0.16

Description The software contains a SQL Injection flaw in the PPOM Meta::get fields by id() function. Insufficient escaping of user-supplied parameters and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. This is exploitable when the Enable Legacy Price Calculations setting is enabled.

Recommendations Update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to version 33.0.16 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-11691

Affected Products

Ppom – Product Addons & Custom Fields For Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11691 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail= · Note
• https://twitter.com/MNovofastovsky/status/1982010384329371948 · Twitter Post
• https://twitter.com/RedPacketSec/status/1979480363085783148 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1979458522212340059 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/classes/ppom.class.php#L337 · Note
• https://t.me/CVEtracker/35269 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve · Note