The specific issue was an SQL injection vulnerability in the admin panel. Within the Tax Settings page of WooCommerce, the key of the ‘tax_rate_country’ POST parameter was passed unescaped into a SQL insert statement. For example, a payload of tax_rate_country[(SELECT SLEEP(10))] would cause the MySQL server to sleep for 10 seconds.
https://www.wordfence.com/blog/2015/03/woocommerce-sql-injection-vulnerability/
This vulnerability affects the following application versions:
- WooCommerce 2.3.0
- WooCommerce 2.3.0-RC1
- WooCommerce 2.3.1
- WooCommerce 2.3.2
- WooCommerce 2.3.3
- WooCommerce 2.3.4
- WooCommerce 2.3.5