Description
The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-11-24
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Disclosure via SQL Injection
Action: Apply patch
AI Analysis

Impact

The Perfect Brands for WooCommerce plugin contains a time‑based SQL injection vulnerability in the brands attribute of the products shortcode. This flaw allows authenticated users with Contributor or higher privileges to inject additional SQL statements, enabling extraction of sensitive information from the WordPress database.

Affected Systems

The vulnerability affects all installations of the Perfect Brands for WooCommerce plugin from its earliest release through version 3.6.2. Users employing any of these versions on a WordPress site are potentially impacted and should verify their plugin version.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, with an EPSS score of less than 1% suggesting a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the site and possess at least Contributor privileges; once logged in, they can use the shortcode to inject malicious SQL. The impact is data disclosure, as attackers can read sensitive database contents.

Generated by OpenCVE AI on April 22, 2026 at 00:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Perfect Brands for WooCommerce plugin to the most recent release, which is expected to contain the fix for the vulnerability.
  • If an upgrade cannot be performed immediately, restrict usage of the products shortcode by disabling it for non‑admin users or by removing the shortcode from the site content.
  • Review Contributor role permissions to ensure only trusted accounts can use the plugin, and monitor database queries for abnormal activity.

Generated by OpenCVE AI on April 22, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Nov 2025 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Quadlayers
Quadlayers perfect Brands For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Quadlayers
Quadlayers perfect Brands For Woocommerce
Wordpress
Wordpress wordpress

Tue, 25 Nov 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
Description The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Quadlayers Perfect Brands For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:33:07.951Z

Reserved: 2025-09-08T20:54:34.933Z

Link: CVE-2025-10144

cve-icon Vulnrichment

Updated: 2025-11-25T18:55:08.523Z

cve-icon NVD

Status : Deferred

Published: 2025-11-24T23:15:46.880

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-10144

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T00:30:04Z

Weaknesses