Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter

This research plan outlines the technical steps to verify the authenticated SQL Injection vulnerability (CVE-2026-11360) in the "Advanced Order Export For WooCommerce" plugin.

1. Vulnerability Summary

• Vulnerability: Authenticated SQL Injection via the sort_direction parameter.
• Location: The vulnerability resides in the SQL generation logic within WC_Order_Export_Data_Extractor (triggered by various AJAX methods in WC_Order_Export_Admin_Tab_Abstract_Ajax_Filters).
• Cause: The plugin fails to validate or sanitize the sort_direction parameter before concatenating it into an ORDER BY clause. Although it uses stripslashes_deep() on the input, this actually removes WordPress's default magic quotes, allowing raw SQL metacharacters (like quotes and backslashes) to reach the database layer without proper preparation.
• Impact: A Shop Manager or Administrator can execute arbitrary SQL queries to extract sensitive data from the WordPress database, including user password hashes and secret keys.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: order_exporter
• Method (Parameter): get_used_custom_order_meta (or any method calling sql_get_order_ids)
• Vulnerable Parameter: sort_direction
• Authentication: Requires a user with Shop Manager (or higher) capabilities.
• Preconditions:
  • WooCommerce must be active.
  • The attacker must possess a valid woe_nonce.
  • The attacker must have the view_woocommerce_reports or export_woocommerce_orders capability (default for Shop Managers).

3. Code Flow

1. Entry Point: The AJAX action order_exporter is registered in the plugin's administration classes.
2. AJAX Handling: Requests are routed to methods within the WC_Order_Export_Admin_Tab_Abstract_Ajax_Filters trait. For example, ajax_get_used_custom_order_meta().
3. Nonce & Capability Check: check_nonce() is called, verifying the woe_nonce parameter.
4. Settings Processing: WC_Order_Export_Manage::make_new_settings( $_POST ) is called, which gathers settings from the request.
5. SQL Generation (Sink): WC_Order_Export_Data_Extractor::sql_get_order_ids( $settings ) is called. Inside this method, the code likely appends $settings['sort_direction'] directly to the SQL query string used to fetch order IDs.
6. Stripping Slashes: The plugin applies stripslashes_deep() to input, which allows characters like ' to bypass WordPress's global sanitization and enter the SQL context.

4. Nonce Acquisition Strategy

The woe_nonce is localized into the admin page using wp_localize_script. It is stored in the global JavaScript object settings_form.

Acquisition Steps:

1. Navigate to the plugin's settings page: /wp-admin/admin.php?page=woo-order-export-lite.
2. Use the browser_eval tool to extract the nonce:

   window.settings_form?.woe_nonce
   

5. Exploitation Strategy

We will use a time-based blind SQL injection payload to confirm the vulnerability.

Step-by-Step Plan:

1. Login: Authenticate as a Shop Manager user.
2. Nonce Capture: Navigate to the export settings page and extract settings_form.woe_nonce.
3. Baseline Request: Send an AJAX request with sort_direction=ASC and measure response time.
4. Injected Request: Send an AJAX request with a SLEEP() payload in the sort_direction parameter.
   • Payload: ASC, (SELECT 1 FROM (SELECT SLEEP(5))A)
5. Execution: Use http_request (Playwright) to send the POST request.

Request Details:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=order_exporter&method=get_used_custom_order_meta&woe_nonce=[NONCE]&sort_direction=ASC, (SELECT 1 FROM (SELECT SLEEP(5))A)
  

6. Test Data Setup

1. WooCommerce: Ensure WooCommerce is installed and set up.
2. Order: Create at least one test order so the query has data to process.
3. User: Create a user with the shop_manager role.
   • wp user create attacker attacker@example.com --role=shop_manager --user_pass=password
4. Plugin Config: No special configuration is needed; the default settings are sufficient.

7. Expected Results

• Baseline: The response should be near-instant (e.g., < 200ms).
• Exploit: The response should be delayed by approximately 5 seconds.
• Response Body: The response will be a JSON object (e.g., ["_billing_first_name", ...]) because the injection occurs in the query that fetches IDs for the meta-analysis.

8. Verification Steps

1. Check the response time of the http_request call.
2. To confirm data extraction, use a boolean-based payload to check the first character of the database version:
   • Payload: ASC, (SELECT 1 FROM (SELECT 1)A WHERE VERSION() LIKE '8%')
   • If the condition is true, the response is normal; if false, the ordering logic might change the response data order or cause a different behavior (if the subquery returns no rows).

9. Alternative Approaches

• Error-Based: If WP_DEBUG is enabled, try inducing a database error using updatexml() or extractvalue() to leak data in the response body.
• UNION-Based: If the sort_direction parameter is injected into a context that allows UNION (unlikely in ORDER BY but possible if the parameter is misused elsewhere), try to match column counts to reflect the admin password hash.
• Other Methods: Try other method values in the order_exporter action, such as get_products_attributes_values, as seen in assets/js/filters.js.