Ni Woocommerce Custom Order Status

ni_woocommerce_custom_order_status

Vendor: Ni Woocommerce Custom Order Status Project • 1 CVE

CVEs (1)

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2021-24846

1Ni Woocommerce Custom Order Status Project

1Ni Woocommerce Custom Order Status

Jun 17, 2026

Dec 21, 2021

N/A· v4

8.8 HIGH· v3

6.5 MEDIUM· v2

The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriberShow less