CVE-2026-12951 in Multi Vendor Plugin
Summary
by MITRE • 10/02/2026
The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query — the value is concatenated directly into an ORDER BY clause where esc_sql() (which only neutralizes characters needed to break out of quoted string literals) provides no protection. This makes it possible for authenticated attackers, with vendor-level access and above (users granted the 'edit_stores' capability), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Dc Woocommerce Multi Vendor plugin for WordPress contains a critical security flaw identified as an unauthenticated or low-privilege SQL injection vulnerability within its REST API implementation. Specifically, this vulnerability resides in the /multivendorx/v1/compliance/report-abuse endpoint and affects versions up to and including 5.0.18. The root cause of this issue is a failure in input validation and sanitization mechanisms when handling the order_by parameter. Instead of properly escaping or preparing user-supplied data before its inclusion in database queries, the application directly concatenates the value into an SQL ORDER BY clause. This architectural oversight allows malicious actors to manipulate the structure of the underlying SQL query, bypassing standard security controls that rely on string literal boundaries for protection.
The technical mechanism behind this vulnerability exploits the limitations of the esc_sql function used by the plugin developers. While esc_sql is designed to neutralize characters that could break out of quoted string literals in INSERT or UPDATE statements, it offers no meaningful protection when input is placed directly into an ORDER BY clause without proper quoting or whitelisting. In SQL syntax, the ORDER BY clause expects column names or positional integers rather than string values enclosed in quotes. By injecting raw user input here, attackers can inject arbitrary SQL commands that are executed by the database engine alongside the legitimate query logic. This specific flaw aligns with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The vulnerability is further characterized under ATT&CK technique T1059, specifically sub-technique 004 for SQL commands, highlighting the execution of structured query language to interact with backend data stores.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and system compromise. Although the attack requires authentication, the required privilege level is relatively low, limited only to vendor-level access or higher, such as users possessing the edit_stores capability. This means that any registered vendor on a compromised WordPress site can exploit this flaw without needing administrative privileges. By appending additional SQL queries to the existing statement, an attacker can extract sensitive information from the database, including user credentials, personal identifiable information of customers and other vendors, financial transaction records, or internal configuration data. In more complex attack scenarios, if the underlying MySQL server is configured with sufficient permissions, this vulnerability could potentially be leveraged for remote code execution through functions like INTO OUTFILE, although such exploitation depends heavily on specific database configurations and security settings.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary and most effective solution is to upgrade the Dc Woocommerce Multi Vendor plugin to a version later than 5.0.18 where this vulnerability has been patched by the developers through proper input sanitization or parameterized queries. For organizations unable to immediately update, implementing Web Application Firewall rules that detect SQL injection patterns in REST API requests targeting the multivendorx endpoint can provide temporary protection. Additionally, database access should be restricted using the principle of least privilege, ensuring that the WordPress database user does not have elevated permissions such as FILE or SUPER privileges, which would limit the potential impact even if an injection occurs. Developers must also adopt secure coding practices by avoiding direct concatenation of user input into SQL queries and instead utilizing prepared statements with parameterized bindings to ensure data is treated strictly as values rather than executable code structures.