What’s Vulnerable › Vulnerabilities

CVE-2023-0277: WC Fields Factory <= 4.1.5 - ShopManager+ SQLi

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-17 · updated 2026-06-17

Description

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Affected products

• WC Fields Factory: through 4.1.5

References

• https://bulletin.iese.de/post/wc-fields-factory_1-4-5
• https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b
• https://bulletin.iese.de/post/wc-fields-factory_1-4-5
• https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b

Get alerted when CVE-2023-0277 or the next vulnerability affects your stack