The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Rearrange Woocommerce Products Plugin | — | Update rearrange-woocommerce-products plugin to version 3.0.8, or a newer patched version | May 15, 2025 | Jan 5, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub