CVE-2026-11360 algolplus CVE debrief

Who should care

Users of the Advanced Order Export For WooCommerce plugin for WordPress, particularly those with shop manager-level access and above, should be aware of this vulnerability and take necessary actions to protect their installations.

Technical summary

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to, and including, 4.0.10. The vulnerability exists due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The endpoint requires a valid woe_nonce and Shop Manager-level capabilities (view_woocommerce_reports or export_woocommerce_orders), and wp_magic_quotes protection is stripped via stripslashes_deep() before processing, allowing quote and backslash characters to survive intact into the SQL context.

Defensive priority

High

Recommended defensive actions

• Update the Advanced Order Export For WooCommerce plugin to a version beyond 4.0.10.
• Restrict access to the plugin's functionality to only trusted users.
• Monitor database activity for suspicious queries.
• Implement additional security measures such as Web Application Firewalls (WAFs) to detect and prevent SQL injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-06-18T06:16:56.957Z and was last modified on 2026-06-18T15:23:56.087Z. The vulnerability was reported by [email protected]. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Affected deployments should be confirmed through internal asset reviews and vendor guidance. Defenders should verify system configurations, monitor for suspicious activity, and review compensating controls.

Official resources