CVE-2026-31920
Received Received - Intake
Blind SQL Injection in Product Rearrange for WooCommerce

Publication date: 2026-03-25

Last updated on: 2026-03-26

Assigner: Patchstack

Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-03-26
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31920
EUVD
EUVD-2026-15817
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
devteam product_rearrange_for_woocommerce to 1.2.2 (inc)
devteam products_rearrange_for_woocommerce to 1.2.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-31920 is a high-priority SQL Injection vulnerability found in the WordPress Product Rearrange for WooCommerce plugin versions up to and including 1.2.2.

This vulnerability allows unauthenticated attackers to perform Blind SQL Injection, meaning they can send specially crafted inputs that the plugin does not properly neutralize, enabling them to interact directly with the website's database.

Such interaction can lead to unauthorized data theft or manipulation without the attacker needing to be logged in.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the website's database.

  • Potential data theft by attackers.
  • Manipulation or corruption of database information.
  • Compromise of website integrity and trustworthiness.

Because the vulnerability can be exploited by unauthenticated attackers, it poses a critical risk to affected websites, potentially leading to widespread exploitation.

Mitigation Strategies

This vulnerability is a high-priority SQL Injection affecting the Product Rearrange for WooCommerce plugin versions up to 1.2.2, allowing unauthenticated attackers to interact with the database.

Since no official patch is currently available, immediate mitigation involves applying Patchstack's mitigation rule to block attacks targeting this flaw.

Once an official patch is released, updating the plugin to the fixed version is strongly advised to fully resolve the issue.

Compliance Impact

CVE-2026-31920 is a high-priority SQL Injection vulnerability that allows unauthenticated attackers to interact directly with the website's database, potentially leading to data theft or manipulation.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data.

Failure to address this vulnerability could result in exposure of protected data, leading to regulatory penalties and loss of trust.

Detection Guidance

There is no specific detection command or method provided for this vulnerability in the available resources.

However, since CVE-2026-31920 is a Blind SQL Injection vulnerability in the Product Rearrange for WooCommerce plugin (versions up to 1.2.2), detection typically involves monitoring for unusual or suspicious SQL queries or HTTP requests targeting the plugin's endpoints.

Patchstack has issued a mitigation rule to block attacks targeting this flaw, which can be used as a temporary protective measure until an official patch is released.

In general, detection commands might include using web application firewalls (WAF) logs or intrusion detection systems (IDS) to look for SQL injection patterns or unusual database queries related to the plugin.

No explicit commands or scripts for detection are provided in the resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart