SQL Injection in WooCommerce Multivendor Marketplace REST API Plugin for WordPress

CVE-2025-1311

What is CVE-2025-1311?

The WooCommerce Multivendor Marketplace REST API plugin for WordPress is susceptible to SQL Injection attacks. The vulnerability arises from the 'id' parameter in the update_delivery_status() function, where insufficient escaping of user-supplied data allows authenticated users with Subscriber-level access or higher to inject malicious SQL code. This can lead to unauthorized access and extraction of sensitive data from the database, potentially compromising the entire site.

References