CVE-2026-11360: SQL Injection in Advanced Order Export For WooCommerce Plugin (Versions ≤4.0.10)

Technical summary

The plugin fails to properly escape and prepare the 'sort_direction' parameter in SQL queries. The vulnerability exists because user-supplied input is passed directly into SQL statements without adequate parameterization. Additionally, the code explicitly calls stripslashes_deep() on user input before SQL processing, which removes WordPress's native magic_quotes protection and allows quote and backslash characters to persist into the SQL context where they can be used to break out of intended query boundaries. This is a classic SQL injection vulnerability (CWE-89) requiring valid nonce tokens and shop manager-level or higher WordPress capabilities to exploit.

Business impact

An attacker with shop manager access could extract sensitive order data, customer information, payment details, or other database records. While the vulnerability is limited to data exfiltration (no write or delete capabilities), the exposure of customer PII and transaction history creates compliance risks under GDPR, PCI DSS, and other regulations. For WooCommerce store operators, this represents a confidentiality breach that could damage customer trust and trigger breach notification obligations.

Affected systems

WordPress installations using the Advanced Order Export For WooCommerce plugin in versions 4.0.10 and earlier are vulnerable. The plugin must be actively installed and at least one user account with shop manager, administrator, or equivalent export/reporting permissions must exist. Systems without this plugin, or with patched versions above 4.0.10, are not affected.

Exploitability

Exploitation requires valid WordPress authentication with shop manager-level or higher permissions, plus a valid woe_nonce token. This substantially limits the threat actor pool to insiders, compromised admin accounts, or accounts obtained through separate credential compromise. The attack is straightforward once authentication is obtained—an attacker can craft a malicious 'sort_direction' parameter value and send it via the vulnerable endpoint. No user interaction or social engineering is required beyond initial account compromise. The CVSS score of 4.9 (Medium) reflects this: high confidentiality impact but gated behind high privilege requirements.

Remediation

Update the Advanced Order Export For WooCommerce plugin to a version newer than 4.0.10. The vendor should have released a patch that properly escapes or uses prepared statements for the 'sort_direction' parameter. Verify the patched version against the official WordPress plugin repository or the vendor's advisory. Until patched, restrict shop manager and export permissions to only trusted personnel, and monitor database query logs for suspicious SQL patterns originating from the plugin's endpoints.

Patch guidance

Check the WordPress plugin update mechanism for Advanced Order Export For WooCommerce. The plugin should notify administrators of available updates. Apply the update to move beyond version 4.0.10. Verify post-update that the plugin version reflects a release date after June 18, 2026 (the CVE publication date). Test the export functionality in a non-production environment before rolling out to production to ensure no regression. If the vendor has not yet released a patch, contact the plugin developer and consider disabling the plugin or restricting its access via WordPress role-based controls until a fix is available.

Detection guidance

Monitor for HTTP requests to WooCommerce export endpoints that contain unusual characters (quotes, semicolons, SQL keywords like UNION, SELECT, WHERE) in the 'sort_direction' parameter. Log analysis tools should flag requests where the parameter value deviates from expected alphanumeric values (asc, desc). WordPress security plugins with SQL injection detection may also flag these attempts. Additionally, monitor database slow query logs or audit logs for unexpected table scans or data exfiltration queries tied to the plugin's database user account. Alert on any export activity by shop managers outside normal business hours or from unexpected geographic locations.

Why prioritize this

Although the CVSS score is Medium (4.9), this vulnerability should be prioritized for rapid remediation in any WooCommerce environment storing sensitive customer or payment data. The attack requires authentication but not necessarily a full admin account—shop managers are often less carefully monitored than administrators. The potential exposure of PII and transaction history creates regulatory and reputational risk. The simplicity of exploitation once authentication is obtained (no complex exploit chain) means that any insider or account compromise directly translates to data theft. Organizations handling PCI DSS or GDPR-regulated data should treat this as a higher priority despite the Medium score.

Risk score, explained

CVSS 4.9 (Medium) reflects: (1) Network-accessible attack vector (AV:N) allowing remote exploitation over HTTP; (2) Low attack complexity (AC:L) with no special conditions beyond authentication; (3) High privilege requirement (PR:H) restricting exploitation to shop manager or administrator accounts; (4) No user interaction needed (UI:N); (5) Unchanged scope (S:U); and critically, (6) High confidentiality impact (C:H) enabling full database read access, but zero integrity or availability impact (I:N, A:N). The privilege gate prevents a higher severity rating despite the data exfiltration capability.

Frequently asked questions