CVE-2022-0412: TI WooCommerce Wishlist plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, a public exploit reference, and very high EPSS probability make this an urgent patch.

What it is

The TI WooCommerce Wishlist plugin (free and Pro) before 1.40.1 fails to sanitise and escape the item_id parameter before using it in a SQL statement in the wishlist/remove_product REST endpoint. This lets unauthenticated attackers inject arbitrary SQL, which matters because the endpoint is reachable without any credentials and the flaw affects a widely deployed WordPress plugin.

Impact

An attacker can read, modify or delete data in the underlying WordPress database, including user credentials and other site content, and may be able to escalate to further compromise depending on database privileges.

Attack surface

Reached over the network via the plugin's wishlist/remove_product REST endpoint; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.73998, 99.457th percentile) and a public exploit reference is tagged on the WPScan advisory, indicating active interest and likely weaponisation.

What to do

• Update TI WooCommerce Wishlist (and Pro) to 1.40.1 or later immediately.
• If patching is not possible, disable the plugin or block access to the wishlist/remove_product REST endpoint.
• Deploy a WAF rule targeting SQL injection patterns on the wishlist REST route.
• Audit the WordPress database and user accounts for signs of tampering after exposure.
• Restrict database account privileges used by WordPress to the minimum required.

Detection

• Monitor web server and WAF logs for requests to the wishlist/remove_product endpoint containing SQL metacharacters or UNION/SELECT patterns.
• Review database query logs for anomalous statements originating from the WordPress application.
• Check for unexpected changes to WordPress users, options or content tables.
• Alert on unauthenticated POST/GET requests to plugin REST routes from unusual source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.