SQL Injection Vulnerability in PPOM – Product Addons & Custom Fields for WooCommerce Plugin
CVE-2025-11691
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 October 2025
What is CVE-2025-11691?
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a vulnerability that allows SQL injection through the PPOM_Meta::get_fields_by_id() function. This issue arises in all versions up to 33.0.15 due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. Unauthenticated attackers can exploit this vulnerability, especially when the 'Enable Legacy Price Calculations' setting is active, to inject additional SQL commands that might extract sensitive database information. Mitigation of this vulnerability is essential to ensure database integrity and protect user data.
Affected Version(s)
PPOM – Product Addons & Custom Fields for WooCommerce * <= 33.0.15