Critical Security Advisory Disclosed 2026-10-27 · 15:09 UTC
Identity withheld until 2027-01-25 (90 days). The maintainer/vendor was notified on 2026-10-27 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3687

Unauthenticated SQL injection in a WordPress WooCommerce e-invoicing plugin

The invoice-generation AJAX endpoint of a WordPress WooCommerce e-invoicing plugin was vulnerable to unauthenticated blind SQL injection. The vendor confirmed the issue and released a fixed version (1.8.1) on 2026-10-27, one day after notification. The 90-day coordinated-disclosure window continues to apply to the identity reveal; site owners should update to the fixed release.

CriticalCoordinated disclosure
Summary

a WordPress WooCommerce e-invoicing plugin exposes an AJAX invoice-generation action to unauthenticated visitors. The handler copies request parameters into $wpdb query strings without prepare(); the applied sanitization preserves single quotes, so the values break out of their SQL string literals. Exploitation is blind/time-based and yields full read access with the site's database privileges. The affected release is current release.

Site owners should deactivate the plugin until a fix ships.

Technical detail
🔒
Technical detail withheld until 2027-01-25 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-25 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.