CVE-2026-11360 describes an SQL Injection vulnerability in the Advanced Order Export For WooCommerce plugin for WordPress. The issue exists in the 'sort_direction' parameter, which is insufficiently escaped and processed without proper SQL query preparation. Authenticated attackers with shop manager-level privileges (capable of viewing WooCommerce reports or exporting orders) can exploit this flaw to inject additional SQL commands, potentially extracting sensitive data from the database. The vulnerability persists in all versions up to and including 4.0.10. The endpoint requires a valid woe_nonce and the stripping of wp_magic_quotes protection via stripslashes_deep() allows special characters to reach the SQL context unescaped. No patch or official remediation is currently documented.

An attacker with shop manager-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not impact availability or integrity but compromises confidentiality. The attack requires authenticated access with specific WooCommerce capabilities, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict shop manager-level access to trusted users only and monitor for unusual activity related to order exports. Avoid granting export or report viewing capabilities to untrusted accounts. Follow vendor communications for updates on patches or official mitigations.