Read the docs
TI-2021-07208 Aliases CVE-2021-24928GHSA-grpm-838p-c5h4

Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.

Why it matters now

EPSS 0.00889 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Rearrange Woocommerce Products (Unknown): 3.0.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownRearrange Woocommerce Products3.0.8 to before 3.0.83.0.8Patch availableCNA
  • Rearrange Woocommerce Products VendorUnknown Affected 3.0.8 to before 3.0.8 Fixed in 3.0.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rearrange_woocommerce_products_project:rearrange_woocommerce_products:*:*:*:*:*:wordpress:*:*before 3.0.8VulnerableRearrange Woocommerce Products Project

Remediation

  • Fix · CNA Rearrange Woocommerce Products (Unknown) Fixed in 3.0.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24928
  2. 2026-10-03 Alias added: GHSA-grpm-838p-c5h4

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences