Executive brief
The eShop plugin for WordPress, which provides shopping cart and order management functionality, contains multiple security flaws. An authenticated user or administrator can execute unauthorized database commands, potentially leading to the theft of customer data, modification of order records, or full compromise of the website's database. This could result in significant data breaches and disruption of e-commerce operations.
Technical details
Multiple SQL injection vulnerabilities exist in 'eshop-orders.php' within the eShop plugin version 6.3.14 for WordPress. The root cause is the failure to sanitize user-supplied input before using it in database queries via the '$wpdb' object. Specifically, the 'delid' and 'view' GET parameters, as well as the 'mark' and 'change' POST parameters, are vulnerable. While some vectors require administrative privileges, others can be exploited by any authenticated user with access to order viewing or status update functions. Successful exploitation allows an attacker to perform blind SQL injection to extract sensitive information from the WordPress database or modify existing records. No official patch was noted in the advisory, which suggests the plugin may be abandoned or requires manual remediation.
Affected products
- Richard Pedley (Elfden) eShop plugin 6.3.14
Timeline
- 2016-01-27: disclosed: Vulnerability discovered by Larry W. Cashdollar
- 2016-01-29: other: Vendor notified
- 2017-01-23: advisory: NVD published the CVE record