CVE-2026-42383: YITH WooCommerce Add-Ons SQLi Flaw

CVE-2026-42383 Overview

CVE-2026-42383 is a blind SQL injection vulnerability in the YITH WooCommerce Product Add-Ons plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all plugin versions from an unspecified earlier release through version 4.29.0. An authenticated attacker with high privileges can inject SQL statements through vulnerable plugin parameters. Successful exploitation enables data extraction from the WordPress database through blind inference techniques. The vulnerability impacts confidentiality at a high level and availability at a low level, with a changed scope that can affect components beyond the plugin itself.

Critical Impact

Authenticated attackers can extract sensitive WordPress database content, including customer data, order details, and credentials, through blind SQL injection against affected YITH WooCommerce Product Add-Ons installations.

Affected Products

• YITH WooCommerce Product Add-Ons plugin versions through 4.29.0
• WordPress sites running WooCommerce with the affected plugin
• E-commerce deployments relying on YITH product customization features

Discovery Timeline

• 2026-05-20 - CVE-2026-42383 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-42383

Vulnerability Analysis

The vulnerability resides in the YITH WooCommerce Product Add-Ons plugin, which extends WooCommerce with custom product option fields. User-supplied input reaches SQL queries without proper sanitization or parameterized query usage. Attackers exploit this gap by injecting SQL syntax into vulnerable parameters processed by the plugin.

The injection follows a blind pattern, meaning query results are not directly returned in HTTP responses. Attackers infer database content through boolean-based or time-based payloads that change application behavior or response timing. This technique allows full extraction of database contents over many requests.

The vulnerability requires high privileges, restricting exploitation to authenticated users with elevated roles such as shop manager or administrator. However, the scope change indicator signals that exploitation can affect resources beyond the vulnerable plugin, including the broader WordPress database and connected data.

Root Cause

The root cause is the construction of SQL queries through string concatenation or interpolation rather than prepared statements with bound parameters. Input passed through plugin endpoints is incorporated into queries without escaping special characters such as single quotes, semicolons, or comment markers. WordPress provides the $wpdb->prepare() API for safe query construction, but the affected code paths bypass this protection.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface or plugin-specific endpoints. The attacker authenticates with a high-privilege account and submits crafted requests containing SQL injection payloads. The plugin processes the input and executes the malicious SQL against the WordPress database.

Blind exploitation typically uses conditional payloads such as AND IF(SUBSTRING(...)=...,SLEEP(5),0) to extract data character by character. Automated tooling like sqlmap can accelerate extraction once a vulnerable parameter is identified.

No verified proof-of-concept code is published in the referenced advisory. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-42383

Indicators of Compromise

• Unusual database query patterns containing SQL keywords such as UNION, SLEEP, BENCHMARK, or SUBSTRING originating from plugin endpoints.
• Spikes in slow query log entries tied to WordPress admin requests submitted by shop manager or administrator accounts.
• Repeated POST or GET requests to YITH plugin endpoints with encoded SQL metacharacters such as %27, %20OR%20, or --.

Detection Strategies

• Inspect WordPress access logs for high-privilege user sessions submitting requests with SQL syntax in parameter values.
• Enable MySQL general query logging on staging environments to identify queries containing concatenated user input from plugin code paths.
• Deploy a web application firewall ruleset that matches OWASP CRS SQL injection signatures against requests targeting /wp-admin/admin-ajax.php and plugin URLs.

Monitoring Recommendations

• Monitor authentication events for newly created or compromised high-privilege WordPress accounts that could be used for exploitation.
• Alert on outbound database response anomalies, including sustained sequences of identical queries with single-character variations characteristic of blind extraction.
• Track plugin version inventory across all WordPress instances and flag deployments still running version 4.29.0 or earlier.

How to Mitigate CVE-2026-42383

Immediate Actions Required

• Update YITH WooCommerce Product Add-Ons to a version newer than 4.29.0 as soon as the vendor publishes a patched release.
• Audit WordPress user accounts and revoke unused high-privilege roles to reduce the population of accounts capable of exploitation.
• Rotate credentials and review database contents for signs of unauthorized access if the plugin has been exposed to untrusted administrative users.

Patch Information

Review the Patchstack SQL Injection Vulnerability advisory for the latest patch status and fixed version availability from YITH. Apply the vendor-supplied update through the WordPress plugin manager and verify the installed version after upgrade.

Workarounds

• Restrict access to the WordPress admin interface using IP allowlists or VPN-only access until a patched plugin version is installed.
• Enforce strong authentication, including multi-factor authentication, on all administrator and shop manager accounts.
• Deploy a web application firewall with SQL injection rules in blocking mode for traffic to WooCommerce and YITH plugin endpoints.

# Configuration example - identify vulnerable plugin installations
wp plugin list --field=name,version | grep yith-woocommerce-product-add-ons