WordPress Wolmart Core plugin <= 1.9.6 - Vulnerabilidade de Injeção SQL (SQL Injection)

The SQL Injection vulnerability in Wolmart Core allows an attacker to bypass security measures and directly interact with the underlying database. Because it's a blind SQL injection, the attacker doesn't receive immediate feedback from the database server, requiring them to infer data through techniques like timing attacks or boolean-based queries. Successful exploitation could lead to the extraction of sensitive user data, including usernames, passwords, email addresses, and order details. Furthermore, an attacker could potentially modify database records, leading to data corruption or unauthorized changes to the website's functionality. The impact is particularly severe given the plugin's likely use in e-commerce sites, where sensitive financial information is often stored.

Websites using the Wolmart Core plugin, particularly those running e-commerce stores, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites using older, unpatched versions of the plugin are most susceptible.

• wordpress / composer / npm:

grep -r "SELECT * FROM wp_" /var/www/html/wp-content/plugins/wolmart-core/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/wolmart-core/ | grep SQL

• wordpress / composer / npm:

wp plugin list | grep wolmart-core

1. 2026-02-20Disclosure

   disclosure

1. Reservado2025-12-31
2. Publicada2026-02-20
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-69337 is to immediately upgrade the Wolmart Core plugin to version 1.9.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement for blind SQL injection, implementing a WAF with generic SQL injection detection rules can provide a layer of defense. Regularly review database access logs for suspicious activity, specifically looking for unusual query patterns or attempts to access sensitive tables. Implement strong database user permissions, limiting the plugin's access to only the necessary data.