SQL Injection Vulnerability in Advanced Order Export For WooCommerce Plugin by WordPress

CVE-2026-11360

What is CVE-2026-11360?

The Advanced Order Export For WooCommerce plugin for WordPress is susceptible to SQL Injection through the 'sort_direction' parameter in versions up to 4.0.10. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of the SQL query, allowing authenticated attackers with shop manager privileges or higher to inject malicious SQL code. Such actions can lead to unauthorized access to sensitive database information. The endpoint also relies on validated nonces and strips out magic quotes protection before processing, which heightens the risk as it allows harmful characters to persist within the SQL context.

References