CVE-2026-111021 in افزونه پیام ووکامرس Plugin
Summary
by MITRE • 10/28/2026
The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of the Persian WooCommerce SMS WordPress plugin prior to 7.3.2 represents a classic instance of Reflected Cross-Site Scripting, technically classified under CWE-79: Improper Neutralization of Input During Web Page Generation. This flaw stems from an insufficient sanitization and escaping mechanism applied to user-supplied input before it is reflected back into the HTML response within an attribute context. The core technical deficiency lies in the application's failure to properly encode special characters that hold semantic meaning in HTML, such as angle brackets, quotes, or ampersands, allowing malicious scripts embedded in the request parameters to be interpreted and executed by the victim's browser rather than being treated as inert data.
The operational impact of this vulnerability is significant due to its reliance on social engineering tactics involving privileged users. Because the exploit requires a logged-in user with administrative privileges to submit a crafted cross-site request, an attacker can leverage Cross-Site Request Forgery techniques combined with malicious links or forms hosted on external domains. When such a victim visits the malicious page or clicks a specially constructed link, their browser automatically includes their active session cookies and authentication tokens in the HTTP request sent to the vulnerable plugin endpoint. The server processes this request without validating its origin, reflects the unescaped input back into the response, and the browser executes the injected JavaScript payload within the context of the trusted WordPress site.
This execution environment grants the attacker full control over the victim's session, enabling actions that are typically restricted to administrators. Potential consequences include complete compromise of the WordPress installation, such as creating new administrative accounts, modifying website content, stealing sensitive customer data stored in WooCommerce databases, or installing additional malicious plugins and backdoors. The attack aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically JavaScript execution within a browser context, which facilitates further lateral movement and persistence on the compromised system.
Mitigation strategies must prioritize immediate patching to version 7.3.2 or later, where the developers have addressed these input validation flaws. In addition to updating software, administrators should implement strict Content Security Policy headers that restrict script execution sources, thereby mitigating the impact of any successful injection attempts even if sanitization fails. Furthermore, enforcing robust Cross-Site Request Forgery protections through anti-CSRF tokens on all state-changing operations is essential to prevent attackers from tricking authenticated users into submitting malicious requests. Regular security audits and code reviews focusing on input handling in WordPress plugins are recommended to identify similar vulnerabilities before they can be exploited in production environments.