CVE-2022-3481: WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-07 · updated 2026-06-17
Weakness: CWE-89

Description

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection

Affected products

OPMC WooCommerce Dropshipping: before 4.4 — fixed in 4.4

How to fix

Upgrade to a fixed version: OPMC WooCommerce Dropshipping 4.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/c5e395f8-257e-49eb-afbd-9c1e26045373
https://wpscan.com/vulnerability/c5e395f8-257e-49eb-afbd-9c1e26045373

Get alerted when CVE-2022-3481 or the next vulnerability affects your stack