PT-2025-47258 · WordPress+1 · Premmerce Wholesale Pricing For Woocommerce+1

Powpy · Published 2025-11-18 · Updated 2025-11-23 · CVE-2025-12411

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Premmerce Wholesale Pricing for WooCommerce plugin for WordPress versions up to and including 1.1.10

Description The software contains a SQL Injection issue due to insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries. This allows authenticated attackers with subscriber-level access or higher to manipulate SQL queries. Exploitation can lead to the extraction of sensitive information from the database and modification of price type display names via the admin-post.php "premmerce update price type" action, resulting in cosmetic corruption of the admin interface. The price type parameter of the "premmerce delete price type" action is also vulnerable. The vulnerable parameter is ID.

Recommendations Update Premmerce Wholesale Pricing for WooCommerce plugin for WordPress to a version later than 1.1.10.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-12411

Affected Products

Premmerce Wholesale Pricing For Woocommerce

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12411 · Security Note
• https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Admin/Admin.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Models/Model.php#L171 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=cve · Note
• https://twitter.com/CVEnew/status/1990703903080693767 · Twitter Post
• https://twitter.com/cracbot/status/1992548742839570897 · Twitter Post