SQL Injection Vulnerability in Perfect Brands for WooCommerce Plugin by WordPress

CVE-2025-10144

What is CVE-2025-10144?

The Perfect Brands for WooCommerce plugin for WordPress is susceptible to SQL injection attacks through the brands attribute of the products shortcode. This issue arises from inadequate escaping of the user-supplied parameter and insufficient preparation of the existing SQL query. As a result, authenticated attackers with Contributor-level access and above can inject additional SQL queries into current ones, facilitating the extraction of sensitive database information. Users are encouraged to update to the latest version to mitigate this vulnerability.

References