Junglewise Threat Intelligence

CVE-2026-11360: AlgolPlus Advanced Order Export For WooCommerce SQL injection

CVE-2026-11360 · Severity: medium · CVSS 4.9 · Published 2026-06-18

Executive brief

The Advanced Order Export For WooCommerce plugin for WordPress, which helps businesses export sales data, contains a security flaw. An attacker with shop manager-level access could exploit this to run unauthorized database commands. This could lead to the theft of sensitive customer and order information from the website's database.

Technical details

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to a generic SQL Injection via the 'sort_direction' parameter in versions up to 4.0.10. The root cause is insufficient escaping of user-supplied input and a lack of SQL query preparation. Specifically, the plugin uses stripslashes_deep() which removes WordPress's built-in magic quotes protection, allowing special characters like quotes and backslashes to reach the SQL context. An attacker requires a valid woe_nonce and Shop Manager-level permissions (view_woocommerce_reports or export_woocommerce_orders) to exploit this vulnerability and append additional queries to extract sensitive data.

Affected products

  • AlgolPlus Advanced Order Export For WooCommerce up to, and including, 4.0.10

Timeline

  • 2026-06-18: disclosed
  • 2026-06-18: advisory

References

Related threats