CVE-2025-24780: Printcart WooCommerce SQLi Vulnerability

CVE-2025-24780 Overview

CVE-2025-24780 is a SQL Injection vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin (printcart-integration) for WordPress. The flaw stems from improper neutralization of special elements passed to SQL queries [CWE-89]. Authenticated attackers with low-privilege access can inject arbitrary SQL statements through vulnerable parameters. The vulnerability affects all plugin versions up to and including 2.4.0. Successful exploitation exposes the WordPress database, enabling data extraction from WooCommerce store tables containing customer records, order details, and configuration secrets.

Critical Impact
Authenticated SQL injection allows attackers to read sensitive database contents, including customer personally identifiable information (PII) and administrative data across the WordPress installation.

Affected Products

Printcart Web to Print Product Designer for WooCommerce plugin (printcart-integration)
All versions from n/a through 2.4.0
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2025-07-04 - CVE-2025-24780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24780

Vulnerability Analysis

The vulnerability resides in the printcart-integration plugin's handling of user-supplied input passed into SQL statements. The plugin fails to properly sanitize or parameterize input before concatenating it into database queries. Attackers with authenticated access at Contributor level or higher can supply crafted payloads that break out of the intended query context. The Common Weakness Enumeration classifies this issue under [CWE-89], Improper Neutralization of Special Elements used in an SQL Command.

The scope is marked as changed, meaning the exploited component can impact resources beyond its security boundary. This reflects WordPress's shared database architecture, where injection into a plugin query can reveal data from core WordPress tables such as wp_users and wp_options.

Root Cause

The root cause is the absence of prepared statements or the $wpdb->prepare() method when constructing SQL queries from HTTP request parameters. Direct string concatenation of untrusted input into query strings allows attacker-controlled characters, such as single quotes and UNION clauses, to alter query logic.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session with low privileges. The attacker sends crafted HTTP requests to a vulnerable plugin endpoint, embedding SQL metacharacters in a parameter that reaches an unsanitized query. The EPSS score is 0.246% at the 15.7th percentile, indicating low observed exploitation activity to date.

The vulnerability is described in prose only, since no verified proof-of-concept code is publicly available. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-24780

Indicators of Compromise

HTTP requests to printcart-integration plugin endpoints containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or information_schema
Unexpected database errors in PHP or WordPress logs referencing the plugin's queries
Authenticated sessions from low-privilege accounts issuing repeated parameterized requests to admin-ajax or REST endpoints tied to the plugin
Outbound data transfers correlated with anomalous query patterns against WooCommerce tables

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags SQL injection payloads targeting /wp-admin/admin-ajax.php and /wp-json/ endpoints for the printcart-integration plugin
Enable MySQL general query logging temporarily to identify malformed or suspicious queries originating from the plugin
Correlate WordPress authentication logs with request patterns to identify low-privilege accounts probing plugin endpoints

Monitoring Recommendations

Alert on HTTP 500 responses from plugin endpoints, which often indicate failed injection attempts
Monitor for spikes in query execution time that suggest time-based blind SQL injection
Track new low-privilege account creation followed by requests to plugin URIs

How to Mitigate CVE-2025-24780

Immediate Actions Required

Update the Printcart Web to Print Product Designer for WooCommerce plugin to a version later than 2.4.0 once a patched release is available from the vendor
If no patched version is available, deactivate and remove the printcart-integration plugin from affected WordPress sites
Audit WooCommerce database tables and WordPress user accounts for signs of unauthorized data access
Rotate WordPress administrator credentials, API keys, and secrets stored in wp_options

Patch Information

At the time of the last NVD update on 2026-06-17, the vulnerability affects all versions through 2.4.0. Review the Patchstack SQL Injection Vulnerability advisory for the latest patched version guidance.

Workarounds

Restrict plugin endpoint access using WAF rules that block SQL metacharacters in request parameters
Limit account creation and reduce privileges of existing Contributor and Subscriber accounts on affected sites
Enforce least-privilege database credentials for the WordPress MySQL user, removing rights such as FILE and cross-database access

bash

# Example WAF rule (ModSecurity) to block common SQLi payloads on plugin endpoints
SecRule REQUEST_URI "@contains printcart" \
    "chain,phase:2,deny,status:403,id:1024780,\
    msg:'Potential SQLi against printcart-integration (CVE-2025-24780)'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|'\s*or\s*'1'='1)" "t:none"