CVE-2025-58788 PoC — WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability

Source

https://github.com/quetuan03/CVE-2025-58788

Associated Vulnerability

Title: WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability (CVE-2025-58788)
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Blind SQL Injection.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.12.

Description

WordPress License Manager for WooCommerce Plugin <= 3.0.12 is vulnerable to SQL Injection

Readme

SINK: The searchProducts() function does not validate input, leading to a SQL Injection vulnerability in the $term variable.
<img width="1037" height="709" alt="image" src="https://github.com/user-attachments/assets/e0a238e3-50e7-442d-8308-0d6799b5bb76" />

- The dropdownDataSearch() function with $type= 'product' allows to control the $term variable while calling the searchProducts() function.
<img width="1073" height="435" alt="image" src="https://github.com/user-attachments/assets/bc5fbc2d-8996-4b52-a46c-08b2c8e67755" />
<img width="920" height="623" alt="image" src="https://github.com/user-attachments/assets/8b487343-4745-4354-8847-dc2471e9ae89" />

POC:
<img width="1918" height="1026" alt="image" src="https://github.com/user-attachments/assets/4e965008-c3ae-4381-8909-7dace7b60e2e" />

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →