CVE-2025-47544: WooCommerce Dynamic Pricing SQLi Flaw

CVE-2025-47544 Overview

CVE-2025-47544 is a blind SQL injection vulnerability in the Acowebs Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. All plugin versions up to and including 4.5.8 are affected. An authenticated attacker with high privileges can inject arbitrary SQL statements through vulnerable parameters. Successful exploitation enables full compromise of the underlying WooCommerce database, including order data, customer records, and credentials.

Critical Impact
Attackers can extract, modify, or delete arbitrary data from the WordPress database, leading to compromise of customer information and store integrity.

Affected Products

Acowebs Dynamic Pricing With Discount Rules for WooCommerce versions through 4.5.8
WordPress sites running the aco-woo-dynamic-pricing plugin
WooCommerce stores using Acowebs dynamic pricing rules

Discovery Timeline

2025-05-07 - CVE-2025-47544 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47544

Vulnerability Analysis

The vulnerability resides in the Acowebs Dynamic Pricing With Discount Rules for WooCommerce plugin, where user-supplied input reaches SQL queries without proper sanitization or parameterization. The plugin fails to neutralize special characters before incorporating them into database statements. This allows an authenticated attacker to manipulate query logic and execute arbitrary SQL.

The issue is classified as blind SQL injection. The application does not return database output directly in responses. Attackers infer query results through inferential techniques such as boolean-based or time-based payloads. Exploitation requires high privileges, narrowing the attacker pool to authenticated users with administrative or elevated roles within WordPress.

Impact spans confidentiality, integrity, and availability. Attackers can read sensitive tables containing customer records, hashed passwords, and order details. They can also modify pricing rules, alter discount logic, or destroy data within the WordPress and WooCommerce schemas.

Root Cause

The root cause is the use of unsanitized input concatenated into SQL queries inside the plugin's pricing and discount management routines. The plugin does not consistently use the WordPress $wpdb->prepare() API or equivalent parameterized statements. This is a classic instance of [CWE-89] - Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface or AJAX endpoints exposed by the plugin. The attacker must hold an authenticated session with high-privilege role. Once authenticated, the attacker sends crafted HTTP requests containing SQL metacharacters in parameters processed by the vulnerable plugin functions. The injected payload is executed against the WordPress database. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-47544

Indicators of Compromise

Unexpected SQL syntax characters such as ', --, UNION, SLEEP(, or BENCHMARK( in WordPress access logs targeting aco-woo-dynamic-pricing endpoints
Repeated POST or GET requests to plugin AJAX handlers with anomalously long parameter values
Sudden spikes in database query response time consistent with time-based blind injection
Modifications to WooCommerce pricing rule tables outside of normal administrative workflows

Detection Strategies

Inspect WordPress and web server access logs for requests to plugin URLs containing SQL keywords or encoded metacharacters
Enable WordPress database query logging and review for malformed queries originating from the plugin
Deploy a web application firewall (WAF) rule set tuned for SQL injection patterns against /wp-admin/admin-ajax.php and plugin paths
Correlate authenticated administrator sessions with unusual query patterns or off-hours activity

Monitoring Recommendations

Monitor administrator and high-privilege account logins for anomalies in source IP, time-of-day, and user agent
Alert on plugin file integrity changes and unexpected modifications to WooCommerce database tables
Track failed login attempts that precede successful administrator authentication

How to Mitigate CVE-2025-47544

Immediate Actions Required

Update the Dynamic Pricing With Discount Rules for WooCommerce plugin to a version newer than 4.5.8 once released by Acowebs
Audit all WordPress administrator and high-privilege accounts and remove unused accounts
Enforce strong passwords and multi-factor authentication for all administrative users
Review database tables for unauthorized modifications to pricing rules, options, and user records

Patch Information

Acowebs has not published a fixed version reference within the available advisory data at the time of writing. Site operators should consult the Patchstack advisory and the plugin's WordPress repository page for updated release information. Apply the patched version as soon as it becomes available.

Workarounds

Deactivate and remove the aco-woo-dynamic-pricing plugin until a patched version is installed
Restrict access to /wp-admin/ using IP allowlisting at the web server or WAF layer
Deploy virtual patching rules through a WAF such as Patchstack, Wordfence, or ModSecurity to block SQL injection payloads targeting plugin endpoints
Apply the principle of least privilege to limit which accounts can configure plugin settings

bash

# Example: disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate aco-woo-dynamic-pricing
wp plugin delete aco-woo-dynamic-pricing

# Example: restrict wp-admin to a specific source IP in nginx
location ^~ /wp-admin/ {
    allow 203.0.113.10;
    deny all;
}