AWcode Toolkit 1.0.24 unauthenticated SQL injection

BugShield Scout discovered a vulnerability in the supplier search in AWcode Toolkit 1.0.24. A visitor without a WordPress account can alter a database query by submitting specially crafted supplier search text. This is SQL injection, and successful exploitation can expose data beyond the intended list of supplier posts. BugShield rates this finding 6/10 (medium). This is a BugShield rating; no CVSS score or vector is assigned. The affected _supplier_filter_function() in includes/class.awtoolkit-woo-product-suppliers.php is registered for logged-out visitors and has no nonce or capability check. It concatenates the requested supplier text into a SQL LIKE query executed with $wpdb->get_results(). BugShield reported the issue to the developer, who confirmed it was fixed in 1.0.25. Review of the published 1.0.25 source confirms removal of the logged-out handler, nonce verification, an edit_products capability check, and a query built with $wpdb->prepare() and $wpdb->esc_like(). The confirmed affected release is 1.0.24; earlier releases were not assessed for this advisory.

Discovered by BugShield Scout. Published by BugShield.