Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2022-4547: The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploit...
CVE-2022-4547 · published 3 years ago
Summary
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| thedotstore | conditional_payment_methods_for_woocommerce |
<= 1.0.0 cpe:2.3:a:thedotstore:conditional_payment_methods_for_woocommerce:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploit...
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
References
- https://bulletin.iese.de/post/conditional-payment-methods-for-woocommerce_1-0/ Broken Link
- https://wpscan.com/vulnerability/fe1514b4-74e1-4c19-8741-c0d4db9bab99 Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published16 Jan 2023
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-4547 · NVD
Track software like this
Free during beta