PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)

Metadata

Affected Target

Summary

The “PPOM for WooCommerce” plugin (WooCommerce Product Addon / PPOM Fields) is vulnerable to an unauthenticated time-based blind SQL injection in its get_product_meta() function, present in versions up to and including 33.0.15. The function concatenates a user-supplied $meta_id parameter directly into a raw SQL query instead of using a prepared statement, and this code path is reachable pre-authentication through the WooCommerce “add to cart” flow when the plugin’s “Enable Legacy Price Calculations” option is active. The included PoC (exploit.py) submits a crafted ppom[fields][id] value containing a SLEEP()-based payload during an add-to-cart POST request and confirms the vulnerability by observing that the server’s response is delayed (and times out) by the injected sleep duration, allowing an attacker to eventually exfiltrate database contents via blind boolean/time-based techniques.

Vulnerability Details

Root Cause

get_product_meta() in classes/plugin.class.php builds its SQL query via string concatenation instead of $wpdb->prepare():

1
2
3
4
5
6
7

function get_product_meta( $meta_id ) {
    // ...
    global $wpdb;
    $qry = 'SELECT * FROM ' . $wpdb->prefix . PPOM_TABLE_META . " WHERE productmeta_id = $meta_id";
    $res = $wpdb->get_row( $qry );
    return $res;
}

Because $meta_id is taken from user-controlled request data (the ppom[fields][id] parameter submitted during WooCommerce’s add-to-cart request) and inserted unsanitized into the query, an attacker can break out of the numeric context and inject arbitrary SQL. This code path is only exercised when the plugin’s “Enable Legacy Price Calculations” setting is enabled, which forces cart operations through the vulnerable legacy pricing logic.

Attack Vector

1. On a site with PPOM for WooCommerce <= 33.0.15 and “Enable Legacy Price Calculations” active, an attacker submits a WooCommerce add-to-cart POST request to a product page that has a PPOM field group attached.
2. The request includes ppom[fields][id] set to a payload such as 1 AND (SELECT 1 FROM (SELECT(SLEEP(7)))A) alongside the standard add-to-cart, quantity, and matching PPOM field parameters.
3. The unsanitized $meta_id value flows into get_product_meta()’s raw SQL query, causing the database to execute the injected SLEEP() clause before returning a result.
4. The attacker measures response time: a delay matching (or exceeding) the injected sleep duration confirms the query executed and the injection point is exploitable, enabling further blind data exfiltration via additional conditional/time-based payloads.

Impact

Unauthenticated blind SQL injection allowing an attacker to extract arbitrary data from the WordPress database (user credentials, session tokens, private order/customer data, etc.) via time-based inference, without needing valid credentials.

Environment / Lab Setup

Target:   Local WordPress + WooCommerce install (e.g. XAMPP/WAMP/MAMP)
Plugin:   PPOM for WooCommerce (woocommerce-product-addon) v33.0.15 — vulnerable copy included in this folder
Config:   PPOM Fields > Settings > "Enable Legacy Price Calculations" must be enabled
Product:  A WooCommerce product with a PPOM field group containing a Text Input field
                 attached (data name e.g. `sql_injection`), published, with a known Product ID
Attacker: Python 3, `pip install requests`

Proof of Concept

PoC Script

See exploit.py and the bundled vulnerable plugin copy under woocommerce-product-addon/ in this folder.

1
2
3

python3 exploit.py

#

Detection & Indicators of Compromise

Signs of compromise:

• Add-to-cart requests with ppom[fields][id] (or other PPOM field parameters) containing non-numeric SQL syntax
• Unusually slow WooCommerce cart/checkout response times correlating with suspicious request parameters
• Database slow-query logs showing SLEEP() or other time-delay function calls originating from productmeta_id lookups

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/aritlhq/CVE-2025-11391 on 2026-07-06. The repository was renamed/transferred but its contents remain intact: exploit.py, a full copy of the vulnerable plugin (v33.0.15) for lab reproduction, and a detailed root-cause writeup with both vulnerable and patched code shown.