title: WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection
description: The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
problem types: CWE-89 SQL Injection
affected:
{
product: WP iCommerce – the first interactive ecommerce for wordpress
vendor: Unknown
versions:
lessThanOrEqual: 1.1.1, status: affected, version: 1.1.1, versionType: custom
}