CVE-2022-0412

What it actually does

TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro before version 1.40.1 contain an unauthenticated SQL injection vulnerability in the REST API endpoint used to remove wishlist items. The vulnerable code fails to sanitize and escape the item_id parameter before incorporating it into a SQL query. Because the endpoint is remotely reachable and does not require authentication or user interaction, an attacker can inject SQL syntax into item_id to manipulate backend database queries. Depending on database permissions and application configuration, this can allow data extraction, data modification, account compromise, creation or alteration of WordPress content, and denial of service through expensive or destructive database operations.

Why it matters to the business

A vulnerable WordPress/WooCommerce site may allow an internet-based attacker to access or alter sensitive store data, including customer information, order-related data, user accounts, and site content. Successful exploitation can lead to data breach exposure, fraud, site defacement, loss of storefront availability, and incident response costs. The risk is high because exploitation is unauthenticated, low-complexity, network-accessible, and has weaponized exploit maturity with a high EPSS score, indicating substantial likelihood of real-world exploitation even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site running a vulnerable version of the TI WooCommerce Wishlist plugin or Pro plugin. They send crafted HTTP requests to the wishlist/remove_product REST endpoint and place SQL control characters or expressions in the item_id parameter. Because the plugin does not properly sanitize or escape that value before using it in a SQL statement, the database interprets part of the attacker-supplied input as SQL. The attacker can then iteratively test boolean, error-based, time-based, or union-style payloads to confirm injection and extract database content. In a typical WordPress/WooCommerce environment, the attacker may attempt to dump user records, password hashes, email addresses, order or customer data, configuration secrets, or manipulate records to gain administrative access or disrupt the site.

How to fix it

Upgrade TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro to version 1.40.1 or later. If an immediate upgrade is not possible, disable or remove the plugin until it can be patched. Restrict access to WordPress REST API routes where feasible, deploy web application firewall rules that block SQL injection payloads against the affected endpoint, and ensure the WordPress database account has only the minimum privileges required by the application. Review WordPress core, themes, and all plugins for additional updates, because exposed WordPress installations are commonly attacked through chained plugin vulnerabilities. After patching, rotate credentials if exploitation is suspected, including WordPress administrator passwords, database credentials, API keys, and WooCommerce-related secrets.

How to confirm the fix worked

Confirm that the installed TI WooCommerce Wishlist or TI WooCommerce Wishlist Pro version is 1.40.1 or later from the WordPress admin plugin inventory, filesystem plugin metadata, or package management records. Verify that unauthenticated requests to the wishlist/remove_product REST endpoint no longer accept SQL control payloads in item_id and do not produce SQL errors, timing anomalies, or different boolean responses. Check that vulnerable plugin files are not retained in backup, staging, or inactive plugin directories reachable by the web server. Validate that WAF or reverse-proxy rules are logging and blocking SQL injection attempts against WordPress REST routes, and perform a controlled vulnerability scan to confirm the exposure is closed.

Typical attack path

1. Scan public websites for WordPress installations using TI WooCommerce Wishlist or TI WooCommerce Wishlist Pro.
2. Determine whether the installed plugin version is older than 1.40.1 through exposed plugin assets, readme files, REST behavior, or fingerprinting.
3. Send an unauthenticated request to the wishlist/remove_product REST endpoint with a crafted item_id parameter containing SQL injection syntax.
4. Confirm vulnerability using response differences, SQL error messages, timing delays, or boolean result changes.
5. Enumerate database structure and extract sensitive WordPress, WooCommerce, or plugin-related data.
6. Optionally modify database records, create or elevate accounts, alter site content, or perform destructive queries to affect availability.
7. Use stolen data or credentials for follow-on access, fraud, resale, or broader compromise.

How to detect it

Investigate historical HTTP access logs from web servers, reverse proxies, load balancers, CDNs, WAFs, and WordPress security plugins for unauthenticated requests to the wishlist/remove_product REST route, especially requests where item_id contains SQL metacharacters, encoded SQL syntax, comments, UNION queries, SELECT statements, sleep/time-delay functions, or boolean conditions. Review database logs, if available, for syntax errors, anomalous SELECT activity against WordPress tables, long-running queries, or queries containing attacker-controlled item_id values. Look for spikes in 400/500 responses, unusual response sizes, or repeated probing from the same source IPs. In WordPress, review administrator user creation/modification times, unexpected plugin/theme changes, modified PHP files, unfamiliar scheduled tasks, and WooCommerce data access anomalies. Because exploit maturity is weaponized and the EPSS score is high, absence of KEV listing should not be treated as absence of exploitation.

• /wishlist/remove_product
• wishlist/remove_product
• item_id=
• item_id=%27
• item_id='
• item_id=%22
• item_id="
• item_id=*
• item_id=0%20or%20
• item_id=0 or
• item_id=1%20and%20
• item_id=1 and
• UNION%20SELECT
• UNION SELECT
• union%20select
• union select
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• WAITFOR%20DELAY
• waitfor%20delay
• information_schema
• INFORMATION_SCHEMA
• /**/
• --%20
• #
• %23
• wp-content/plugins/ti-woocommerce-wishlist
• wp-content/plugins/ti-woocommerce-wishlist-premium

What your security team should do

• Prioritize patching or disabling TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro versions earlier than 1.40.1 because exploitation is unauthenticated, high-impact, and weaponized.
• Inventory all public WordPress and WooCommerce sites for the affected plugin, including inactive copies, staging sites, and legacy storefronts.
• Review web server, WAF, CDN, and application logs for historical requests to wishlist/remove_product containing SQL injection syntax in the item_id parameter.
• If suspicious activity is found, perform incident response: preserve logs, identify accessed data, inspect WordPress administrator accounts, review recent content or plugin changes, and rotate credentials.
• Add detection rules for SQL injection patterns targeting WordPress REST endpoints and specifically the wishlist/remove_product route.
• Restrict database privileges used by WordPress and verify that database accounts cannot perform unnecessary administrative operations.
• Harden WordPress by limiting plugin installation rights, disabling file editing from the admin console, enforcing MFA for administrators, and keeping all plugins and themes updated.