---
title: "SQL Injection Vulnerability in WordPress Cart66 Lite Plugin"
url: https://securityorb.com/sql-injection-vulnerability-wordpress-cart66-lite-plugin/
type: post
date: 2015-01-20
modified: 2015-01-20
markdown_url: https://securityorb.com/sql-injection-vulnerability-wordpress-cart66-lite-plugin.md
author: "Kellep Charles"
---

# SQL Injection Vulnerability in WordPress Cart66 Lite Plugin

# SQL Injection Vulnerability in WordPress Cart66 Lite Plugin

**Vector:**
Remote

**Severity:**
Low

**Patch:**
Patched

**Impact:**
Data Manipulation

**Software:**
WordPress Cart66 Lite Plugin 1.x , vulnerable versions: <=1.5.1.17

SQL inection vulnerability has been discovered in WordPress Cart66 Lite Plugin.

Vulnerability is caused by an input validation error while processing the "id" POST parameter to wp-admin/admin-ajax.php (when "action" is set to "shortcode_products_table"). A remote attacker can send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in application`s database.

Further exploitation of this vulnerability may result in unauthorized data manipulation.

**Solution:**
For WordPress Cart66 Lite Plugin 1.x: Update to version 1.5.2.
Links:

 
- [http://wordpress.org/plugins/cart66-lite/changelog/](http://www.naked-security.com/bitrix/redirect.php?event1=news_out&event2=http%3A%2F%2Fwordpress.org%2Fplugins%2Fcart66-lite%2Fchangelog%2F&event3=SQL+Injection+Vulnerability+in+WordPress+Cart66+Lite+Plugin&goto=http%3A%2F%2Fwordpress.org%2Fplugins%2Fcart66-lite%2Fchangelog%2F)
 
- [http://security.szurek.pl/cart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html](http://www.naked-security.com/bitrix/redirect.php?event1=news_out&event2=http%3A%2F%2Fsecurity.szurek.pl%2Fcart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html&event3=SQL+Injection+Vulnerability+in+WordPress+Cart66+Lite+Plugin&goto=http%3A%2F%2Fsecurity.szurek.pl%2Fcart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html)