What’s Vulnerable › Vulnerabilities

CVE-2022-0948: Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-09 · updated 2026-06-17
• Weakness: CWE-89

Description

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection

Affected products

• Order Listener for WooCommerce – Play Sounds Instantly on New Orders: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: Order Listener for WooCommerce – Play Sounds Instantly on New Orders 3.2.2. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2707223
• https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576
• https://plugins.trac.wordpress.org/changeset/2707223
• https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576

Get alerted when CVE-2022-0948 or the next vulnerability affects your stack