CVE-2025-24767: SQL Injection in TicketBAI WooCommerce Plugin

The SQL Injection vulnerability in TicketBAI Facturas para WooCommerce allows an attacker to bypass security measures and directly interact with the underlying database. Due to the 'blind' nature of the injection, attackers must infer data through repeated queries, making exploitation potentially time-consuming but still highly impactful. Successful exploitation could lead to the exfiltration of sensitive customer data, order information, financial details, and potentially even administrative credentials stored within the WooCommerce database. This could result in significant data breaches, financial losses, and reputational damage for affected e-commerce sites. The blind nature of the attack means it may be difficult to detect without specific monitoring in place.

1. Reserved2025-01-23
2. Published2025-06-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-24767 is to immediately upgrade the TicketBAI Facturas para WooCommerce plugin to version 3.19.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL injection attempts targeting the vulnerable endpoints. Specifically, look for unusual characters and patterns in user input that are commonly associated with SQL injection attacks. Regularly review and sanitize all user inputs to prevent future vulnerabilities. Monitor database logs for suspicious activity, such as unusual query patterns or errors.

Active installs

60

Plugin rating