CVE-2025-11691: PPOM WooCommerce Plugin SQLi Vulnerability

CVE-2025-11691 Overview

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a SQL Injection vulnerability in the PPOM_Meta::get_fields_by_id() function. This security flaw exists in all versions up to and including 33.0.15 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. The vulnerability allows unauthenticated attackers to append additional SQL queries into already existing queries, enabling extraction of sensitive information from the database.

Critical Impact

Unauthenticated attackers can extract sensitive database information including user credentials, customer data, and other confidential information stored in the WordPress database when the "Enable Legacy Price Calculations" setting is enabled.

Affected Products

• PPOM – Product Addons & Custom Fields for WooCommerce plugin versions up to and including 33.0.15
• WordPress installations using the vulnerable PPOM plugin with Legacy Price Calculations enabled
• WooCommerce stores utilizing PPOM for custom product fields and addons

Discovery Timeline

• 2025-10-18 - CVE CVE-2025-11691 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11691

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) resides within the PPOM_Meta::get_fields_by_id() function in the PPOM plugin's core class file. The vulnerability occurs because user-supplied input is directly incorporated into SQL queries without proper sanitization or parameterization. When the "Enable Legacy Price Calculations" setting is activated, the vulnerable code path becomes accessible to unauthenticated users, significantly expanding the attack surface.

The flaw allows attackers to manipulate database queries by injecting malicious SQL statements through user-controlled parameters. Since no authentication is required to reach the vulnerable endpoint, any remote attacker can exploit this vulnerability to extract data from the WordPress database, including potentially sensitive information such as user credentials, customer payment details, and order information.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and SQL query parameterization in the PPOM_Meta::get_fields_by_id() function. The plugin fails to implement WordPress's prepared statements ($wpdb->prepare()) or adequate escaping mechanisms when constructing SQL queries with user-supplied data. This oversight allows malicious input to break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector

The attack vector for CVE-2025-11691 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the WordPress site running the vulnerable PPOM plugin. The attack is only successful when the "Enable Legacy Price Calculations" option is enabled in the plugin settings.

The attacker constructs malicious payloads that manipulate the SQL query executed by the get_fields_by_id() function. By appending UNION-based or boolean-based blind SQL injection payloads, the attacker can systematically extract database contents. The vulnerability is located in the plugin's class file at classes/ppom.class.php around line 337. For technical details on the vulnerable code, see the WordPress Code Review.

Detection Methods for CVE-2025-11691

Indicators of Compromise

• Unusual database query patterns or errors in WordPress logs indicating SQL injection attempts
• Unexpected or anomalous HTTP requests targeting PPOM plugin endpoints with special characters or SQL syntax
• Evidence of data exfiltration attempts in web server access logs with encoded SQL payloads
• Suspicious activity patterns from unauthenticated sources accessing product addon functionality

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests targeting WordPress plugins
• Monitor WordPress error logs for SQL syntax errors or database query failures that may indicate exploitation attempts
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns
• Review web server access logs for requests containing SQL keywords (UNION, SELECT, INSERT, etc.) in query parameters

Monitoring Recommendations

• Enable detailed logging for WordPress database queries to identify anomalous query patterns
• Set up real-time alerting for failed database queries or unusual data access patterns
• Monitor outbound network traffic for signs of data exfiltration following potential SQL injection attacks
• Regularly audit PPOM plugin settings to ensure Legacy Price Calculations is disabled if not required

How to Mitigate CVE-2025-11691

Immediate Actions Required

• Update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to a patched version beyond 33.0.15
• Disable the "Enable Legacy Price Calculations" setting immediately if the plugin cannot be updated
• Implement WAF rules to block SQL injection attempts targeting the affected endpoints
• Review database access logs for signs of prior exploitation and potential data compromise

Patch Information

The vulnerability has been addressed in versions newer than 33.0.15 of the PPOM plugin. The patch implements proper SQL query parameterization using WordPress's $wpdb->prepare() function to ensure user input is safely escaped before being incorporated into database queries. Administrators should update to the latest available version as soon as possible. The security fix can be reviewed in the WordPress Changeset Log. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the "Enable Legacy Price Calculations" setting in PPOM plugin configuration (Settings → PPOM → Legacy Options)
• Implement server-level input validation to filter SQL injection patterns before they reach WordPress
• Use a Web Application Firewall (WAF) with SQL injection protection rules enabled
• Restrict access to WordPress admin and plugin endpoints using IP allowlisting if feasible

# WordPress wp-config.php - Enable database query logging for monitoring
define('SAVEQUERIES', true);

# .htaccess - Block common SQL injection patterns (Apache)
RewriteEngine On
RewriteCond %{QUERY_STRING} (union.*select|select.*from|insert.*into|drop.*table) [NC]
RewriteRule .* - [F,L]