2wstechnologies vulnerabilities and threats

The Askeet WordPress plugin for WooCommerce data is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions in all versions up to and including 3.0. The vulnerability arises because the askeet_is_safe_query() filter can be bypassed using MySQL conditional comments, allowing authenticated administrators to append additional SQL queries. This can lead to unauthorized extraction of sensitive database information. The CVSS score is 4.9 (medium severity). No official patch or remediation guidance is currently available.