YITH WooCommerce Product Add-Ons SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in the YITH WooCommerce Product Add-Ons plugin, affecting versions through 4.29.0. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to interact with the database in unauthorized ways.

Impact

Exploitation of this vulnerability could lead to blind SQL injection, allowing attackers to manipulate the database and potentially access or modify sensitive information.

Remediation

Users of the YITH WooCommerce Product Add-Ons plugin should update to version 4.29.1 or later to address this vulnerability. Patchstack users can enable auto-updates for vulnerable plugins.