CVE-2026-11360

Name of the Vulnerable Software and Affected Versions Advanced Order Export For WooCommerce versions prior to 4.0.11

Description The Advanced Order Export For WooCommerce plugin for WordPress contains a generic SQL Injection flaw. This issue arises from insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with shop manager-level access or higher can append additional SQL queries to extract sensitive information from the database. The exploitation requires a valid woe nonce and specific capabilities, such as view woocommerce reports or export woocommerce orders. The vulnerability is facilitated by the use of the stripslashes deep() function, which removes wp magic quotes protection and allows quote and backslash characters to remain intact within the SQL context. The affected parameter is sort direction.

Recommendations Update the plugin to a version later than 4.0.10. As a temporary workaround, restrict access to the sort direction parameter for users without administrative privileges.