Askeet — Talk to Your WooCommerce Data
Askeet — Talk to Your WooCommerce Data (askeet) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 4.9.
askeetCVE-2026-5651: Askeet conditional-comment bypass permits administrator SQL injection
Askeet through 3.0 passes the sql_query parameter to the askeet_execute_sql_query and askeet_export_all_results AJAX actions. askeet_is_safe_query() strips ordinary block comments before checking for forbidden SQL keywords, but MySQL conditional comments such as /*!UNION*/ remain executable and bypass that filter. An Administrator can append SQL capable of extracting sensitive database information. This 4.9-scored record received deeper review because the underlying primitive is SQL injection; the CNA does not disclose the final SQL execution function.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-5651
Askeet conditional-comment bypass permits administrator SQL injection
Askeet through 3.0 passes the sql_query parameter to the askeet_execute_sql_query and askeet_export_all_results AJAX actions. askeet_is_safe_query() strips ordinary block comments before checking for forbidden SQL keywords, but MySQL conditional comments such as /*!UNION*/ remain executable and bypass that filter. An Administrator can append SQL capable of extracting sensitive database information. This 4.9-scored record received deeper review because the underlying primitive is SQL injection; the CNA does not disclose the final SQL execution function.
|
> 3.0 |
CVE4.9
NVDPending
|