WordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerability

Successful exploitation of this SQL Injection vulnerability could grant an attacker complete control over the WooCommerce database. This includes the ability to read, modify, or delete sensitive customer data such as usernames, passwords, addresses, and payment information. Furthermore, an attacker could potentially gain administrative access to the WooCommerce store, enabling them to modify products, orders, and other critical configurations. The blast radius extends to all users of the affected WooCommerce store, and the potential for data breaches and financial loss is significant. This vulnerability shares similarities with other SQL Injection exploits where attackers leverage database queries to bypass authentication and escalate privileges.

WooCommerce store owners utilizing the WhatsCart plugin, particularly those running versions 0.0 through 1.1.0, are at significant risk. Shared hosting environments where multiple WordPress installations share the same database are especially vulnerable, as a compromise of one site could potentially affect others. Stores that have not implemented robust database security practices or regularly update their plugins are also at increased risk.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/whatscart-for-woocommerce/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/whatscart-for-woocommerce/ | grep SQL

• wordpress / composer / npm:

wp plugin list --status=inactive | grep whatscart

• wordpress / composer / npm:

wp plugin list --status=active | grep whatscart

1. 2025-05-23Disclosure

   disclosure

1. Reservado2025-03-26
2. Publicada2025-05-23
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-31056 is to immediately upgrade the WhatsCart plugin to version 1.1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with rules to filter out potentially malicious SQL queries targeting the vulnerable endpoints. Additionally, review and restrict database user permissions to minimize the impact of a successful attack. Monitor database logs for suspicious SQL queries that may indicate an ongoing attack. There are no specific Sigma or YARA rules available for this particular vulnerability at this time.