CVE-2026-31920
Blind SQL Injection in Product Rearrange for WooCommerce
Publication date: 2026-03-25
Last updated on: 2026-03-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devteam | product_rearrange_for_woocommerce | to 1.2.2 (inc) |
| devteam | products_rearrange_for_woocommerce | to 1.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31920 is a high-priority SQL Injection vulnerability found in the WordPress Product Rearrange for WooCommerce plugin versions up to and including 1.2.2.
This vulnerability allows unauthenticated attackers to perform Blind SQL Injection, meaning they can send specially crafted inputs that the plugin does not properly neutralize, enabling them to interact directly with the website's database.
Such interaction can lead to unauthorized data theft or manipulation without the attacker needing to be logged in.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the website's database.
- Potential data theft by attackers.
- Manipulation or corruption of database information.
- Compromise of website integrity and trustworthiness.
Because the vulnerability can be exploited by unauthenticated attackers, it poses a critical risk to affected websites, potentially leading to widespread exploitation.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability is a high-priority SQL Injection affecting the Product Rearrange for WooCommerce plugin versions up to 1.2.2, allowing unauthenticated attackers to interact with the database.
Since no official patch is currently available, immediate mitigation involves applying Patchstack's mitigation rule to block attacks targeting this flaw.
Once an official patch is released, updating the plugin to the fixed version is strongly advised to fully resolve the issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-31920 is a high-priority SQL Injection vulnerability that allows unauthenticated attackers to interact directly with the website's database, potentially leading to data theft or manipulation.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data.
Failure to address this vulnerability could result in exposure of protected data, leading to regulatory penalties and loss of trust.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific detection command or method provided for this vulnerability in the available resources.
However, since CVE-2026-31920 is a Blind SQL Injection vulnerability in the Product Rearrange for WooCommerce plugin (versions up to 1.2.2), detection typically involves monitoring for unusual or suspicious SQL queries or HTTP requests targeting the plugin's endpoints.
Patchstack has issued a mitigation rule to block attacks targeting this flaw, which can be used as a temporary protective measure until an official patch is released.
In general, detection commands might include using web application firewalls (WAF) logs or intrusion detection systems (IDS) to look for SQL injection patterns or unusual database queries related to the plugin.
No explicit commands or scripts for detection are provided in the resources.