CVE-2022-0948
Published: April 11, 2026
Official Description
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
Risk Analysis
A SQL injection vulnerability exists in the Order Listener for WooCommerce WordPress plugin, allowing unauthenticated users to inject malicious SQL commands via a REST route. Given its presence in CISA's KEV catalog and active exploitation, this flaw poses an urgent threat.
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog, making it a critical concern.
Update the Order Listener for WooCommerce WordPress plugin to version 3.2.2 or later to patch the SQL injection vulnerability.
Technical Analysis
CVE-2022-0948 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2022-0948 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-0948 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1