ELEX WooCommerce Request a Quote WordPress: SQL injection

What this flaw is

SQL injection lets an attacker inject their own queries into the site database. They can read its entire contents: passwords, customer data, order details.

It is one of the most common routes to a personal-data leak and account takeover, and therefore a real GDPR breach risk.

Score breakdown (CVSS vector)

What the CVSS 8.6 rating means in practice:

• The attack can be carried out remotely, over the internet.
• No login or account required.
• Requires no action from the victim.
• The impact may reach beyond the vulnerable component itself.
• At risk: data confidentiality.

Weakness class: CWE-89.

How to fix: SQL injection

• Update the vulnerable component to the patched version; if none exists, disable it.
• Assume the database may have been read: rotate all user and admin passwords and force a re-login.
• Check the database for injected administrator accounts, spam content and modified options.
• If it holds personal data, assess whether this is a GDPR-reportable breach.
• Consider a WAF rule blocking the vulnerable parameter until you can patch.

Prefer not to do this yourself? We will handle the update, check for signs of a break-in and secure the site. Write to us →

Other current WordPress threats