Advanced Order Export For WooCommerce <= 4.1.2 - Authenticated (Shop Manager+) SQL Injection via Multiple Export Filter Settings
- ID
- WPSEC-2026-0812
- Plugin
- Advanced Order Export For WooCommerce (woo-order-export-lite)
- Affected
- all versions before 4.1.3
- Remediation
- Update to 4.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Advanced Order Export For WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to SQL Injection via multiple export filter settings in all versions up to, and including, 4.1.2 due to insufficient escaping on the user-supplied parameters and lack of sufficient preparation on the existing SQL queries. The values of list filters (such as order statuses, coupons, payment and shipping methods, products and product vendors) were placed inside quoted SQL strings without escaping, product item meta filter keys were used in table aliases with only addslashes() applied, and the sort meta key was added to the query without escaping. This makes it possible for authenticated attackers with Shop Manager-level access and above, or any user given the plugin's export capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0812/
- https://plugins.svn.wordpress.org/woo-order-export-lite/tags/4.1.3/
- https://wordpress.org/plugins/woo-order-export-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS