Executive brief
WooCommerce is an e-commerce plugin for WordPress used by online retailers to manage product catalogs, orders, and payments. A SQL injection vulnerability in the Analytics reports feature allows attackers to extract sensitive database information such as customer data, order details, and payment information through specially crafted requests. An attacker with access to the Analytics reports section could potentially read or manipulate the underlying database.
Technical details
The vulnerability is a blind SQL injection flaw in the WooCommerce Analytics reports module, specifically affecting the woocommerce_date_type parameter. The vulnerable code fails to properly sanitize or parameterize user-supplied input before constructing SQL queries. An attacker with access to the Analytics reports functionality can inject arbitrary SQL code to extract data via time-based or boolean-based blind SQL injection techniques. The issue affects WooCommerce versions before 11.0, and a fix has been merged into the release/11.0 branch as of August 2026.
Affected products
- Automattic WooCommerce before 11.0
Timeline
- 2026-09-04: disclosed
- 2026-08-10: patched: Fix merged into release/11.0