[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4b548NKybsWj6BNk72RjUZM3CS5vv9Pj5M0ZNfz-GuM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-57810","wc-shop-sync-square-payment-gateway-and-product-synchronization-for-woocommerce-authenticated-subscriber-sql-injection","WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce \u003C= 4.7.4 - Authenticated (Subscriber+) SQL Injection","The WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","woosquare",null,"\u003C=4.7.4","4.7.5","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-09 00:00:00","2026-07-14 19:19:31",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fce8474eb-a521-4739-bc3f-3782deb3bc9f?source=api-prod",6,[22,23,24,25,26,27,28],"admin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php","admin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php","includes\u002Ffreemius\u002Fassets\u002Fjs\u002Fpricing\u002Ffreemius-pricing.js","includes\u002Ffreemius\u002Fincludes\u002Fclass-freemius.php","includes\u002Ffreemius\u002Fstart.php","readme.txt","woocommerce-square-integration.php","researched",false,3,"I cannot fulfill your request to produce a detailed exploitation research plan or functional payloads for CVE-2026-57810. My safety guidelines prohibit the generation of actionable material that could facilitate the exploitation of software vulnerabilities, as this information poses significant security risks.\n\nIf you are interested in WordPress security and defense, I recommend exploring the following resources:\n\n1.  **WordPress Developer Documentation (Security):** Review the official guides on \"Database Security\" and \"Validating, Sanitizing, and Escaping User Data\" to understand how to correctly use functions like `$wpdb->prepare()` to prevent SQL injection.\n2.  **OWASP Top 10:** Consult the OWASP (Open Web Application Security Project) documentation on Injection vulnerabilities for general principles of prevention and mitigation in web applications.\n3.  **Vulnerability Patch Analysis:** You can analyze the difference between the vulnerable version (4.7.4) and the patched version (4.7.5) of the \"WC Shop Sync\" plugin to see how the developers mitigated the issue.\n4.  **Security Best Practices:** Information regarding securing WordPress installations is available through the WordPress Codex and various reputable cybersecurity blogs focused on defensive engineering.","The WC Shop Sync plugin for WordPress is vulnerable to authenticated SQL injection due to the lack of proper preparation in SQL queries and insufficient authorization checks on AJAX actions. Attackers with subscriber-level access can exploit this to inject arbitrary SQL commands via manipulated product attribute data during synchronization, potentially leading to unauthorized data extraction.","\u002F\u002F admin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php:2011\n$attrexpl = explode( '[', $attrr );\nglobal $wpdb;\n$attr = $wpdb->$get_results( 'SELECT * FROM `' . $wpdb->prefix . \"woocommerce_attribute_taxonomies` WHERE `attribute_name` = '\" . strtolower( $attrexpl[0] ) . \"'\" );\n\n---\n\n\u002F\u002F admin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php:2046\nglobal $wpdb;\n$get_resul = $wpdb->$get_results( 'SELECT * FROM `' . $wpdb->prefix . \"terms` WHERE `slug` = '\" . strtolower( $ternameval ) . \"' ORDER BY `name` ASC\", true );\n\n---\n\n\u002F\u002F admin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php:2125\nfunction update_square_to_woo_action() {\n\tif ( ! isset( $_POST['nonce'] ) ||\n\t\t( function_exists( 'wp_verify_nonce' ) && ! empty( $_POST['nonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'my_woosquare_ajax_nonce' ) )\n\t) {\n\t\t\u002F\u002F Missing strict termination and capability checks","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.4\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.5\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.4\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php\t2026-05-04 09:47:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.5\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fadmin\u002Fajax.php\t2026-07-02 10:38:40.000000000 +0000\n@@ -2122,9 +2122,11 @@\n  * Additionally, it updates relevant metadata and status.\n  *\u002F\n function update_square_to_woo_action() {\n-\tif ( ! isset( $_POST['nonce'] ) ||\n-\t\t( function_exists( 'wp_verify_nonce' ) && ! empty( $_POST['nonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'my_woosquare_ajax_nonce' ) )\n-\t) {\n+\tif ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'my_woosquare_ajax_nonce' ) ) {\n+\t\twp_die( esc_html( __( 'Cheatin’ huh?', 'woosquare' ) ) );\n+\t}\n+\t\u002F\u002F phpcs:ignore WordPress.WP.Capabilities.Unknown -- WooCommerce core capability.\n+\tif ( ! current_user_can( 'manage_woocommerce' ) ) {\n \t\twp_die( esc_html( __( 'Cheatin’ huh?', 'woosquare' ) ) );\n \t}\n \t$woo_product_sync_log_transientt = get_transient( 'woo_product_sync_log_transient' );\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.4\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.5\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.4\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php\t2026-05-04 09:47:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoosquare\u002F4.7.5\u002Fadmin\u002Fmodules\u002Fproduct-sync\u002F_inc\u002Fclass-squaretowoosynchronizer.php\t2026-07-02 10:38:40.000000000 +0000\n@@ -2008,7 +2009,12 @@\n \n \t\t\t\t$attrexpl = explode( '[', $attrr );\n \t\t\t\tglobal $wpdb;\n-\t\t\t\t$attr = $wpdb->$get_results( 'SELECT * FROM `' . $wpdb->prefix . \"woocommerce_attribute_taxonomies` WHERE `attribute_name` = '\" . strtolower( $attrexpl[0] ) . \"'\" );\n+\t\t\t\t$attr = $wpdb->$get_results(\n+\t\t\t\t\t$wpdb->$prepare(\n+\t\t\t\t\t\t\"SELECT * FROM `{$wpdb->prefix}woocommerce_attribute_taxonomies` WHERE `attribute_name` = %s\",\n+\t\t\t\t\t\tstrtolower( $attrexpl[0] )\n+\t\t\t\t\t)\n+\t\t\t\t);","The exploit targets the Square-to-WooCommerce synchronization process. An authenticated attacker with at least Subscriber-level privileges can trigger the `update_square_to_woo_action` AJAX action. Because the version 4.7.4 fails to enforce strict capability checks (relying on a weak nonce check that may be bypassed or obtained), an attacker can supply malicious data that mimics a Square product object. Specifically, the attacker injects SQL into variation names or attribute strings. When the plugin processes these strings using `explode()` and concatenates the resulting segments into raw SQL queries within the `SquareToWooSynchronizer` class, the injected SQL is executed against the WordPress database.","gemini-3-flash-preview","2026-07-15 22:04:03","2026-07-15 22:05:08",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","4.7.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoosquare\u002Ftags\u002F4.7.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoosquare.4.7.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoosquare\u002Ftags\u002F4.7.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoosquare.4.7.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoosquare\u002Ftags"]