CVE Intelligence
Analysis AI-assisted

CVE-2026-31920: Product Rearrange for WooCommerce SQL Injection

CVE-2026-31920 is an SQL injection flaw (CWE-89) in the Product Rearrange for WooCommerce plugin by Devteam HaywoodTech, which the record describes as allowing blind SQL injection. The record gives an affected range from n/a through 1.2.2 and a critical CVSS 3.1 base score of 9.3 from the CNA. The sources consulted list no fixed version, no confirmed exploitation and no KEV entry.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-31920 concerns a SQL injection weakness (CWE-89) in Product Rearrange for WooCommerce, a plugin from Devteam HaywoodTech. The record describes the flaw as allowing blind SQL injection, and the reference URL indicates the product is a WordPress plugin.

Impact

  • Blind SQL injection can let an attacker influence database queries and infer data stored by the application.
  • The CVSS vector in the record indicates network reachability, low complexity, no privileges and no user interaction required, with a changed scope.
  • The record scores confidentiality impact as high, integrity impact as none and availability impact as low.

Affected products and versions

  • Product: Product Rearrange for WooCommerce (slug products-rearrange-woocommerce), by Devteam HaywoodTech.
  • Range stated in the record: from n/a through 1.2.2 inclusive.
  • The structured affected and fixes fields in the record are empty, so the range comes only from the description text.

Exploitation status

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS probability is reported as 0.004 with a percentile of 0.32423. These values are a statistical estimate and do not confirm real-world attacks.

Remediation and mitigation

  • Identify every site running Product Rearrange for WooCommerce and check whether the installed version is 1.2.2 or earlier.
  • The record does not name a fixed version. Check the vendor or the Patchstack entry for an update and apply it as soon as it is available.
  • If no update exists yet, consider disabling or removing the plugin until a fixed release is confirmed, and review whether it is needed.
  • Keep WordPress, WooCommerce and other plugins current, and limit database account privileges to what the site needs.

Detection guidance

  • Review web server and application logs for unusual parameters or repeated requests to the plugin's endpoints, especially with changing response times or errors.
  • Monitor database logs for unexpected query patterns originating from the web application.
  • Compare installed plugin files and versions against your asset inventory to find outdated copies.

Limitations of the available information

  • The record contains no fixed version, no patch reference beyond the Patchstack entry and no vendor advisory.
  • The affected lower bound is written as n/a, so the earliest vulnerable version is unknown.
  • The source status in the record is Deferred, so NVD analysis may still change.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so its timing should be verified before relying on it.

Frequently asked questions

Which versions of Product Rearrange for WooCommerce are affected by CVE-2026-31920?

The record lists the affected range as from n/a through 1.2.2 inclusive. The structured affected field is empty, so confirm the exact range with the vendor or Patchstack.

Is CVE-2026-31920 known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS value reported is 0.004.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.