nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-0948 CVE-2022-0948
CRITICALNuclei
Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi
Record summary
CVE-2022-0948 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.
Description
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Mar 9, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Order Listener for WooCommerce – Play Sounds Instantly on New Orders | CVE List | 3.2.2 to < 3.2.2 | affected |
order_listener_for_woocommerceBrowse pluginbazaar / order_listener_for_woocommerce | VulnCheck | Version data not supplied | |
Nuclei templates
1ProjectDiscoveryCRITICALWordPress Order Listener for WooCommerce <3.2.2 - SQL InjectionCVSS 9.8
WordPress Order Listener for WooCommerce plugin before 3.2.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
Remediation
Update the WordPress Order Listener for WooCommerce plugin to version 3.2.2 or later.
WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022wpunauthsqliwoc-order-alertwpscanwordpresswp-pluginpluginbazaarvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:pluginbazaar:order_listener_for_woocommerce:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576 https://wordpress.org/plugins/woc-order-alert/ https://plugins.trac.wordpress.org/changeset/2707223 https://nvd.nist.gov/vuln/detail/CVE-2022-0948 https://github.com/ARPSyndicate/kenzer-templates
Source: ProjectDiscovery
References
3plugins.trac.wordpress.orgConfirmation
https://plugins.trac.wordpress.org/changeset/2707223 wpscan.com
https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576