CVE-2025-48118: WooCommerce Partial Shipment SQLi Flaw

CVE-2025-48118 Overview

CVE-2025-48118 is a SQL Injection vulnerability affecting the WpExperts Hub WooCommerce Partial Shipment plugin (wc-partial-shipment) for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. Attackers with low-privilege authenticated access can inject malicious SQL statements through the affected plugin. The vulnerability affects all versions of the plugin up to and including 3.2. Successful exploitation can expose sensitive WooCommerce order data, customer information, and other data stored in the WordPress database.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing customer and order data with a scope change that extends impact beyond the vulnerable component.

Affected Products

WpExperts Hub WooCommerce Partial Shipment plugin versions through 3.2
WordPress installations running wc-partial-shipment with WooCommerce
E-commerce sites relying on the plugin for partial shipment functionality

Discovery Timeline

2025-06-17 - CVE-2025-48118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48118

Vulnerability Analysis

The vulnerability resides in the WooCommerce Partial Shipment plugin's handling of user-supplied input passed to SQL queries. The plugin fails to properly sanitize or parameterize input before incorporating it into database queries. An authenticated attacker with low privileges can submit crafted parameters that break out of the intended query context. The injected SQL is then executed by the WordPress database backend with the plugin's database privileges.

The scope change indicates that the impact extends beyond the vulnerable component itself, reaching resources controlled by other security authorities such as the broader WordPress database. The EPSS score of 0.246% places this near the 15th percentile for likelihood of exploitation activity.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-89]. The plugin constructs SQL queries using concatenation or interpolation of untrusted input without applying $wpdb->prepare() or equivalent parameterized query mechanisms. Special characters such as single quotes and SQL meta-characters pass through unsanitized into the executed query string.

Attack Vector

Exploitation requires network access and low-privilege authentication to the WordPress instance. An authenticated user submits crafted input through a plugin endpoint or parameter that is reflected into a SQL query. The malicious payload alters the query's logic, enabling data extraction through techniques such as UNION-based, error-based, or boolean-blind SQL injection. No user interaction is required beyond the attacker's own request submission.

No verified proof-of-concept code is publicly available. See the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2025-48118

Indicators of Compromise

Unexpected SQL syntax patterns such as UNION SELECT, OR 1=1, or SLEEP( in HTTP request parameters targeting wc-partial-shipment endpoints
Anomalous database query durations or error log entries referencing the plugin's PHP files
Outbound data flows from the WordPress host shortly after authenticated requests to the plugin
New or modified WordPress administrator accounts following plugin endpoint access

Detection Strategies

Inspect WordPress access logs for requests to plugin endpoints containing URL-encoded SQL meta-characters such as %27, %20UNION%20, or --
Enable MySQL/MariaDB general query logging temporarily to identify malformed queries originating from the plugin
Deploy a web application firewall rule set tuned for SQL injection signatures against /wp-admin/admin-ajax.php and plugin routes

Monitoring Recommendations

Forward WordPress, web server, and database logs to a centralized analytics platform for correlation
Alert on authentication events followed within seconds by parameterized requests containing SQL keywords
Track row counts returned by plugin queries and alert on bulk data extraction patterns

How to Mitigate CVE-2025-48118

Immediate Actions Required

Identify all WordPress sites running the WooCommerce Partial Shipment plugin and inventory installed versions
Restrict authenticated access to trusted users until a patched version is verified and deployed
Deploy WAF rules blocking SQL injection patterns directed at wc-partial-shipment endpoints
Rotate database credentials and audit recent WordPress administrator account activity

Patch Information

As of this writing, the vendor advisory listed by Patchstack covers all versions up to and including 3.2. Administrators should consult the Patchstack SQL Injection Advisory for the latest fixed version information and apply updates through the WordPress plugin manager once available.

Workarounds

Disable and remove the WooCommerce Partial Shipment plugin if partial shipment functionality is not business-critical
Limit plugin access via WordPress role and capability restrictions, allowing only verified administrators
Apply a virtual patch through a WAF or Patchstack vPatch ruleset blocking known injection payloads
Enforce database least-privilege so the WordPress MySQL user cannot read tables outside the WooCommerce schema

bash

# Configuration example: WordPress MySQL least-privilege grant
REVOKE ALL PRIVILEGES ON *.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress_db.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;