CVE-2025-11691

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11691", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T15:24:04.178Z", "datePublished": "2025-10-18T06:42:49.184Z", "dateUpdated": "2026-04-08T17:31:52.371Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:52.371Z"}, "affected": [{"vendor": "themeisle", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "33.0.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled."}], "title": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/classes/ppom.class.php#L337"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "timeline": [{"time": "2025-10-14T17:24:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T18:11:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T17:56:07.756295Z", "id": "CVE-2025-11691", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T17:59:48.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T17:56:07.756295Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T17:56:26.574Z"}}], "cna": {"title": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "themeisle", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "33.0.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T17:24:49.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T18:11:36.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/classes/ppom.class.php#L337"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-18T06:42:49.184Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11691", "state": "PUBLISHED", "dateUpdated": "2025-10-20T17:59:48.112Z", "dateReserved": "2025-10-13T15:24:04.178Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:49.184Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "vendor": "themeisle", "versions": [{"lessThanOrEqual": "33.0.15", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled."}, {"lang": "es", "value": "El plugin PPOM - Product Addons & Custom Fields para WooCommerce para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de la funci\u00f3n PPOM_Meta::get_fields_by_id() en todas las versiones hasta, e incluyendo, la 33.0.15 debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos. Esto solo es explotable cuando la configuraci\u00f3n Enable Legacy Price Calculations est\u00e1 habilitada."}], "id": "CVE-2025-11691", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11691", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T17:56:07.756295Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:35.707", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/classes/ppom.class.php#L337"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:42:36.991690+00:00", "value": {"mitigation_remediation": ["Upgrade the PPOM plugin to the latest available version, which removes the vulnerable code.", "If an immediate update is not feasible, disable the Enable Legacy Price Calculations setting to eliminate the injection vector.", "Restrict the database user\u2019s privileges to a minimum\u2011necessary set, reducing the impact should an injection occur."], "summary": {"action": "Patch Now", "impact": "Data Exfiltration"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the themeisle PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin from all versions up to and including 33.0.15. It is only exploitable when the Enable Legacy Price Calculations setting is enabled.", "description_and_impact": "The flaw lies in the PPOM_Meta::get_fields_by_id() function where user input is not escaped and the resulting SQL query is not prepared, allowing an unauthenticated attacker to inject arbitrary SQL. By appending malicious statements to the query, the attacker can retrieve sensitive data from the WordPress database, such as customer records, order information, or other private tables, leaking confidential information.", "risk_and_exploitability": "The CVSS score of 7.5 signals a high severity, while an EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in CISA's KEV catalog. The likely attack path requires sending crafted HTTP requests to the plugin's endpoint with the Enable Legacy Price Calculations setting enabled; no authentication is needed. Successful exploitation gives an attacker the ability to read all data returned by the vulnerable query, compromising confidentiality across the site."}}}}, "created": "2025-10-20T13:21:38.574124+00:00", "updated": "2026-04-22T00:45:04.163027+00:00", "vendors": ["themeisle", "themeisle$PRODUCT$product_addons_&_fields_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}