CVE-2025-12411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12411", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T15:27:58.347Z", "datePublished": "2025-11-18T08:27:30.246Z", "dateUpdated": "2026-04-08T16:40:46.504Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:46.504Z"}, "affected": [{"vendor": "premmerce", "product": "Premmerce Wholesale Pricing for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL queries that can be used to extract sensitive information from the database and modify price type display names in the database via the admin-post.php \"premmerce_update_price_type\" action, causing cosmetic corruption of the admin interface. The 'price_type' parameter of the \"premmerce_delete_price_type\" is also vulnerable."}], "title": "Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Models/Model.php#L171"}, {"url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Admin/Admin.php#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465244/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Powpy"}], "timeline": [{"time": "2025-10-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-17T20:08:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T14:25:17.699297Z", "id": "CVE-2025-12411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:35:18.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T14:25:17.699297Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T14:25:19.682Z"}}], "cna": {"title": "Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Powpy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}}], "affected": [{"vendor": "premmerce", "product": "Premmerce Wholesale Pricing for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-17T20:08:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Models/Model.php#L171"}, {"url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Admin/Admin.php#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465244/"}], "descriptions": [{"lang": "en", "value": "The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL queries that can be used to extract sensitive information from the database and modify price type display names in the database via the admin-post.php \"premmerce_update_price_type\" action, causing cosmetic corruption of the admin interface. The 'price_type' parameter of the \"premmerce_delete_price_type\" is also vulnerable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:46.504Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12411", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:40:46.504Z", "dateReserved": "2025-10-28T15:27:58.347Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:30.246Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Premmerce Wholesale Pricing for WooCommerce", "vendor": "premmerce", "versions": [{"lessThanOrEqual": "1.1.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL queries that can be used to extract sensitive information from the database and modify price type display names in the database via the admin-post.php \"premmerce_update_price_type\" action, causing cosmetic corruption of the admin interface. The 'price_type' parameter of the \"premmerce_delete_price_type\" is also vulnerable."}, {"lang": "es", "value": "El plugin Premmerce Wholesale Pricing for WooCommerce para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'ID' en versiones hasta la 1.1.10, inclusive. Esto se debe a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, manipulen consultas SQL que pueden usarse para extraer informaci\u00f3n sensible de la base de datos y modificar los nombres de visualizaci\u00f3n de tipos de precios en la base de datos a trav\u00e9s de la acci\u00f3n \u201cpremmerce_update_price_type\u201d de admin-post.php, causando una corrupci\u00f3n cosm\u00e9tica de la interfaz de administraci\u00f3n. El par\u00e1metro 'price_type' del \u201cpremmerce_delete_price_type\u201d tambi\u00e9n es vulnerable."}], "id": "CVE-2025-12411", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12411", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T14:25:17.699297Z", "version": "2.0.3"}}]}, "published": "2025-11-18T09:15:48.510", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Admin/Admin.php#L83"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Models/Model.php#L171"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3465244/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:40:16.667220+00:00", "value": {"mitigation_remediation": ["Update Premmerce Wholesale Pricing for WooCommerce to a version newer than 1.1.10.", "If an update is not possible, disable the \"premmerce_update_price_type\" and \"premmerce_delete_price_type\" actions by removing or altering the corresponding admin\u2011post.php hooks.", "Implement strict input validation and use prepared statements for all database interactions within the plugin code."], "summary": {"action": "Apply Patch", "impact": "Data Exposure, Database Modification"}, "threat_synthesis": {"affected_systems": "Premmerce Wholesale Pricing for WooCommerce plugin, versions up to 1.1.10 installed on any WordPress site.", "description_and_impact": "The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL injection via the 'ID' parameter in versions up to and including 1.1.10, as well as the 'price_type' parameter of the \"premmerce_delete_price_type\" action. The flaw arises from insufficient escaping and lack of prepared statements, which allows an attacker who can log in with subscriber level or higher permissions to inject arbitrary SQL into queries executed against the WordPress database. This weakness can lead to extraction of sensitive data stored in the database and manipulation of price type display names, thereby corrupting the administrative interface and potentially undermining the integrity of product pricing.\n\nThe attack requires authenticated access; the attacker must first be logged into the WordPress site with a role of subscriber or higher, which is a prerequisite for interacting with the vulnerable admin-post.php endpoints. Once authenticated, the attacker can supply crafted values for the affected parameters, causing the plugin to construct and execute malicious SQL statements.\n\nThe plugin\u2019s vendor is Premmerce, and the product is Premmerce Wholesale Pricing for WooCommerce. The vulnerability exists in all released versions up to 1.1.10, meaning any installation that has not upgraded beyond that point is at risk.\n", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low but not negligible, and the vulnerability is not yet listed in CISA\u2019s KEV catalog. The exploitation path is relatively straightforward for an authenticated user: by sending crafted requests to admin-post.php with the vulnerable parameters, the attacker can inject and execute arbitrary SQL within the context of the WordPress database. The impact spans both confidentiality, through data exfiltration, and integrity, via unauthorized modifications to pricing data. Mitigation is essential to prevent potential compromise of sensitive information and disruption of e\u2011commerce pricing structures."}}}}, "created": "2025-11-18T14:16:00.765232+00:00", "updated": "2026-04-22T16:45:21.459861+00:00", "vendors": ["premmerce", "premmerce$PRODUCT$wholesale_pricing_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}