CVE-2026-2579
SQL Injection in WowStore WooCommerce Plugin Allows Data Exposure
Publication date: 2026-03-17
Last updated on: 2026-03-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | product_blocks | to 4.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress has a vulnerability known as SQL Injection in all versions up to and including 4.4.3. This occurs because the plugin does not properly escape the 'search' parameter supplied by users and fails to adequately prepare the existing SQL query. As a result, unauthenticated attackers can inject additional SQL commands into the query, potentially extracting sensitive information from the database.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to perform SQL Injection attacks via the 'search' parameter. The impact is that attackers can append malicious SQL queries to existing ones, which can lead to unauthorized extraction of sensitive data from the database. This compromises the confidentiality of the data stored by the plugin and can lead to data breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability is an SQL Injection in the 'search' parameter of the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress, affecting all versions up to 4.4.3. Detection would involve monitoring for unusual or malicious SQL query patterns targeting this parameter.
Since the vulnerability is triggered via the 'search' parameter in REST API or plugin requests, detection can be attempted by inspecting HTTP requests to the WordPress site for suspicious payloads in the 'search' parameter that include SQL syntax such as ' OR ', ' UNION ', or other SQL keywords.
- Use web server logs or network monitoring tools to filter requests containing suspicious SQL keywords in the 'search' parameter.
- Example command to search Apache logs for suspicious 'search' parameter usage: grep -iE "search=.*(union|select|or|and|--|#)" /var/log/apache2/access.log
- Use tools like curl or wget to test the endpoint manually by sending crafted requests with SQL injection payloads in the 'search' parameter and observe the response for errors or data leakage.
- Example curl command to test the vulnerability: curl -G 'https://yourwordpresssite.com/wp-json/wopb/v1/product-search' --data-urlencode "search=' OR 1=1--"
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WowStore – Store Builder & Product Blocks for WooCommerce plugin to a version later than 4.4.3 where the SQL Injection vulnerability is fixed.
If an update is not immediately possible, consider temporarily disabling the plugin or restricting access to the vulnerable endpoints by IP or authentication to prevent unauthenticated attackers from exploiting the 'search' parameter.
Additionally, implement Web Application Firewall (WAF) rules to block requests containing typical SQL injection patterns targeting the 'search' parameter.
- Update the plugin to the latest secure version.
- Restrict or disable access to the vulnerable REST API endpoints if possible.
- Apply WAF or security plugin rules to block SQL injection attempts.
- Monitor logs for suspicious activity and respond accordingly.