CVE-2021-24846
HIGHNi WooCommerce Custom Order Status <1.9.7 - SQL Injection
Title source: llmDescription
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/a1e7cd2b-8400-4c5d-8b47-a8ccd1e21675
Scores
CVSS v3
8.8
EPSS
0.0132
EPSS Percentile
67.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
ni_woocommerce_custom_order_status_project/ni_woocommerce_custom_order_status
< 1.9.7
Published
Dec 21, 2021
Tracked Since
Feb 18, 2026