Critical severity9.8NVD Advisory· Published Feb 28, 2022· Updated Jun 17, 2026
CVE-2022-0412
CVE-2022-0412
Description
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- Range: <1.40.1
1.40.1+ 3 more
- (no CPE)range: 1.40.1
- (no CPE)range: 1.40.1
- cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:*:wordpress:*:*range: <1.40.1
- cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:pro:wordpress:*:*range: <1.40.1
Patches
Vulnerability mechanics
References
2- wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682nvdExploitThird Party Advisory
- plugins.trac.wordpress.org/changeset/2668899nvdRelease NotesThird Party Advisory
News mentions
0No linked articles in our index yet.