CVE-2026-0702

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0702", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T23:31:05.534Z", "datePublished": "2026-01-28T08:26:55.318Z", "dateUpdated": "2026-04-08T17:13:25.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:25.663Z"}, "affected": [{"vendor": "wpcreatix", "product": "VidShop \u2013 Shoppable Videos for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VidShop \u2013 Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "VidShop \u2013 Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L224"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441106/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Peerapat Samatathanyakorn"}], "timeline": [{"time": "2026-01-08T17:27:55.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-27T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T16:09:48.004488Z", "id": "CVE-2026-0702", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:10:33.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T16:09:48.004488Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:10:11.705Z"}}], "cna": {"title": "VidShop \u2013 Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Peerapat Samatathanyakorn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wpcreatix", "product": "VidShop \u2013 Shoppable Videos for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-08T17:27:55.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-27T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L224"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297"}, {"url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441106/"}], "descriptions": [{"lang": "en", "value": "The VidShop \u2013 Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:25.663Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0702", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:13:25.663Z", "dateReserved": "2026-01-07T23:31:05.534Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T08:26:55.318Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VidShop \u2013 Shoppable Videos for WooCommerce", "vendor": "wpcreatix", "versions": [{"lessThanOrEqual": "1.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VidShop \u2013 Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin VidShop \u2013 Shoppable Videos para WooCommerce para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'fields' en todas las versiones hasta la 1.1.4, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite que atacantes no autenticados a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-0702", "lastModified": "2026-06-17T10:11:14.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0702", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T16:09:48.004488Z", "version": "2.0.3"}}]}, "published": "2026-01-28T09:15:48.820", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L224"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3441106/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T18:59:24.289808+00:00", "value": {"mitigation_remediation": ["Update the VidShop plugin to the latest version that removes the SQL injection vulnerability.", "Limit access to the plugin\u2019s REST API endpoints so that only authenticated, authorized users can specify the 'fields' parameter.", "Deploy a web application firewall or similar filtering mechanism to detect and block SQL injection payloads targeting the 'fields' parameter."], "summary": {"action": "Patch Immediately", "impact": "SQL Injection (unauthenticated) enabling extraction of sensitive database data"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin developed by WPCreatix named VidShop \u2013 Shoppable Videos for WooCommerce, with all releases up to and including version 1.1.4. Users of any version in that range are exposed; updating to a later release beyond 1.1.4 removes the issue.", "description_and_impact": "The VidShop \u2013 Shoppable Videos for WooCommerce plugin is vulnerable to a time\u2011based SQL injection that allows unauthenticated attackers to use the \"fields\" parameter to inject or append arbitrary SQL statements into existing queries, thereby extracting sensitive information from the database. This flaw is a classic CWE\u201189 vulnerability that compromises data confidentiality by permitting read\u2011only access to database contents without any form of authentication.", "risk_and_exploitability": "The CVSS score for this flaw is 7.5, indicating a high severity, while the EPSS score is less than 1% and the vulnerability has not been added to CISA\u2019s KEV catalogue. The attack vector is unauthenticated and relies on sending a crafted 'fields' value to the plugin\u2019s REST\u2011API endpoint, which does not require user credentials. Deployment of the flaw results in data exfiltration without code execution, but it can still expose confidential database content to attackers. Given the low exploitation probability, the risk to already protected sites remains moderate, yet the severity warrants immediate action."}}}}, "created": "2026-01-29T09:18:13.429369+00:00", "updated": "2026-04-15T19:00:12.319533+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpcreatix", "wpcreatix$PRODUCT$vidshop_\u2013_shoppable_videos_for_woo_commerce"]}