The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL injection via the 'ID' parameter in versions up to and including 1.1.10, as well as the 'price_type' parameter of the "premmerce_delete_price_type" action. The flaw arises from insufficient escaping and lack of prepared statements, which allows an attacker who can log in with subscriber level or higher permissions to inject arbitrary SQL into queries executed against the WordPress database. This weakness can lead to extraction of sensitive data stored in the database and manipulation of price type display names, thereby corrupting the administrative interface and potentially undermining the integrity of product pricing. The attack requires authenticated access; the attacker must first be logged into the WordPress site with a role of subscriber or higher, which is a prerequisite for interacting with the vulnerable admin-post.php endpoints. Once authenticated, the attacker can supply crafted values for the affected parameters, causing the plugin to construct and execute malicious SQL statements. The plugin’s vendor is Premmerce, and the product is Premmerce Wholesale Pricing for WooCommerce. The vulnerability exists in all released versions up to 1.1.10, meaning any installation that has not upgraded beyond that point is at risk.

Premmerce Wholesale Pricing for WooCommerce plugin, versions up to 1.1.10 installed on any WordPress site.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low but not negligible, and the vulnerability is not yet listed in CISA’s KEV catalog. The exploitation path is relatively straightforward for an authenticated user: by sending crafted requests to admin-post.php with the vulnerable parameters, the attacker can inject and execute arbitrary SQL within the context of the WordPress database. The impact spans both confidentiality, through data exfiltration, and integrity, via unauthorized modifications to pricing data. Mitigation is essential to prevent potential compromise of sensitive information and disruption of e‑commerce pricing structures.