CVE-2026-0702: VidShop WordPress Plugin SQLi Vulnerability

CVE-2026-0702 Overview

CVE-2026-0702 is a time-based SQL injection vulnerability in the VidShop – Shoppable Videos for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.1.4. It stems from insufficient escaping of the user-supplied fields parameter and a lack of proper query preparation in the existing SQL statement. Unauthenticated attackers can append additional SQL clauses to existing queries and extract sensitive data from the WordPress database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials, order data, and customer personally identifiable information (PII), from affected WooCommerce stores.

Affected Products

VidShop – Shoppable Videos for WooCommerce plugin for WordPress, all versions up to and including 1.1.4
WordPress sites running WooCommerce with the VidShop plugin installed
Patched in the changeset published via the WordPress Changeset Report

Discovery Timeline

2026-01-28 - CVE-2026-0702 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0702

Vulnerability Analysis

The vulnerability resides in the plugin's REST API video controller, specifically in the request handlers documented around lines 224 and 297 of class-videos-controller.php. The fields parameter supplied by the client is passed into a query construction routine in class-query-builder.php at line 778. The plugin does not properly escape this parameter, and the resulting SQL statement is not prepared using $wpdb->prepare() with appropriate placeholders. As a result, attacker-controlled input is concatenated directly into the executed query. This is a textbook time-based blind SQL injection, where attackers infer query results by measuring server response latency induced by SQL functions such as SLEEP() or BENCHMARK().

Root Cause

The root cause is a combination of two defects: insufficient sanitization of the fields REST parameter and missing parameterized query preparation in the underlying query builder. The plugin treats the fields value as a trusted column list rather than validating it against an allowlist of permitted column names. Concatenation of untrusted input into SQL violates the WordPress database access guidelines that mandate $wpdb->prepare() for any query containing variables.

Attack Vector

Attackers exploit the issue by sending crafted HTTP requests to the VidShop REST API endpoint exposed by the plugin. Because the endpoint is reachable without authentication, exploitation requires no user account or interaction. Adversaries inject payloads into the fields query parameter to trigger time-delayed responses that disclose database contents one bit at a time. Successful exploitation yields read access to any table the WordPress database user can reach, including wp_users (password hashes and emails) and WooCommerce order tables (customer data).

No verified public exploit code is available at this time. Refer to the Wordfence Vulnerability Report and the affected source files in the WordPress REST API File and WordPress Query Builder File for technical details.

Detection Methods for CVE-2026-0702

Indicators of Compromise

HTTP requests to the VidShop REST API routes under /wp-json/ containing fields parameter values with SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or comment sequences like -- and /*.
Web server access logs showing repeated requests to the same VidShop endpoint with incremental parameter variations, consistent with blind SQL injection enumeration.
Abnormally long response times for VidShop REST endpoints, indicative of time-based payloads triggering database delays.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for SQL metacharacters in the fields query parameter on VidShop REST routes.
Enable WordPress query logging (SAVEQUERIES) in non-production environments to identify unprepared queries originating from the plugin.
Correlate database slow query logs with corresponding HTTP request timestamps to identify time-based injection attempts.

Monitoring Recommendations

Alert on unauthenticated REST API calls to VidShop endpoints that include suspicious payload patterns in URL parameters.
Monitor for outbound data egress spikes from WordPress hosts following requests to the affected plugin endpoints.
Track the installed version of the VidShop plugin across managed WordPress fleets and flag any host still running version 1.1.4 or earlier.

How to Mitigate CVE-2026-0702

Immediate Actions Required

Update the VidShop – Shoppable Videos for WooCommerce plugin to the version published in WordPress Changeset 3441106, which supersedes 1.1.4.
If immediate patching is not possible, deactivate and remove the VidShop plugin from the WordPress site.
Rotate WordPress administrator passwords, API keys, and WooCommerce secrets on any site that exposed the vulnerable endpoint to the internet.

Patch Information

The vendor fix is tracked in the WordPress Changeset Report. The patched release introduces proper input validation on the fields parameter and uses prepared statements in class-query-builder.php. Administrators should verify the installed version under WordPress Admin → Plugins after applying the update. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deploy a WAF rule that blocks requests to VidShop REST API routes when the fields parameter contains SQL keywords or non-alphanumeric characters outside the expected column-name allowlist.
Restrict access to /wp-json/ endpoints by IP allowlist for environments that do not require public REST API access.
Apply WordPress hardening to remove the VidShop plugin directory until the patched version can be installed and validated.

bash

# Example ModSecurity rule blocking suspicious 'fields' parameter values
SecRule ARGS:fields "@rx (?i)(select|union|sleep|benchmark|--|/\*)" \
    "id:1026702,phase:2,deny,status:403,\
    msg:'CVE-2026-0702 VidShop SQLi attempt blocked',\
    tag:'cve-2026-0702',tag:'sqli'"