Risk Letters

Exploited vulnerability

CVE-2022-0412

TLP:CLEAR

templateinvaders ti_woocommerce_wishlist Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks

Facts

  • Vendor: templateinvaders
  • Product: ti_woocommerce_wishlist
  • EPSS (probability of exploitation within 30 days): 74 %
  • First known exploitation: 16 September 2026
  • First seen by Risk Letters: 16 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD