{"id":7204,"date":"2014-10-31T07:09:29","date_gmt":"2014-10-31T13:09:29","guid":{"rendered":"https:\/\/www.siteground.com\/blog\/?p=7204"},"modified":"2025-09-18T14:49:21","modified_gmt":"2025-09-18T14:49:21","slug":"wp-ecommerce-vulnerability","status":"publish","type":"post","link":"https:\/\/www.siteground.com\/blog\/wp-ecommerce-vulnerability\/","title":{"rendered":"WP eCommerce Plugin Vulnerability Fixed"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7123\" src=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2014\/10\/wpecommerce.jpg\" alt=\"bash\" width=\"540\" height=\"181\"><\/p>\n<p>Yesterday Sucuri reported a new <a href=\"https:\/\/blog.sucuri.net\/2014\/10\/security-advisory-medium-severity-wp-ecommerce-wordpress-plugin.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">vulnerability in WP eCommerce<\/a> &#8211; a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain private information from websites. All versions of the WP eCommerce extension before 3.8.14.4 are vulnerable and attackers may export all user accounts, addresses and other information related to people, who used your site and the plugin to purchase any products from your site.<br>\n<!--more--><\/p>\n<p>We immediately wrote our own WAF security rules to block malicious requests that try to take advantage of this vulnerability. We performed extensive tests to make sure that regular requests will not be blocked. However, in some cases malicious requests cannot be differentiated from regular authorized requests and some users may be blocked by our WAF even if they are the administrators of the site. We advise all site owners that use the WP eCommerce extension to upgrade it to the latest stable version 3.8.14.4. If you\u2019re using the WP eCommerce extension and you see an error that your request is blocked by our WAF please post a support ticket via our HelpDesk and we will resolve the case for you.<\/p>\n\n\n<p>[subscribe_cta]<\/p>\n","protected":false},"excerpt":{"rendered":"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain private information from websites. All versions of the WP eCommerce extension before 3.8.14.4 are vulnerable and attackers may export all user accounts, addresses and other information related to people, who used your&hellip;","protected":false},"author":57,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2098,12,15],"tags":[],"class_list":["post-7204","post","type-post","status-publish","format-standard","hentry","category-hosting-insights","category-security","category-wordpress"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.2) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>WP eCommerce Plugin Vulnerability Fixed : SiteGround Blog<\/title>\n<meta name=\"description\" content=\"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WP eCommerce Plugin Vulnerability Fixed\" \/>\n<meta property=\"og:description\" content=\"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain\" \/>\n<meta property=\"og:url\" content=\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"SiteGround\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/siteground\" \/>\n<meta property=\"article:published_time\" content=\"2014-10-31T13:09:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-18T14:49:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"540\" \/>\n\t<meta property=\"og:image:height\" content=\"181\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Daniel Kanchev\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@siteground\" \/>\n<meta name=\"twitter:site\" content=\"@siteground\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Daniel Kanchev\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\"},\"author\":{\"name\":\"Daniel Kanchev\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/380162a677d6c37329e9a12baa334572\"},\"headline\":\"WP eCommerce Plugin Vulnerability Fixed\",\"datePublished\":\"2014-10-31T13:09:29+00:00\",\"dateModified\":\"2025-09-18T14:49:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\"},\"wordCount\":193,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2014\/10\/wpecommerce.jpg\",\"articleSection\":[\"Hosting Insights\",\"Security\",\"WordPress\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\",\"name\":\"WP eCommerce Plugin Vulnerability Fixed : SiteGround Blog\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2014\/10\/wpecommerce.jpg\",\"datePublished\":\"2014-10-31T13:09:29+00:00\",\"dateModified\":\"2025-09-18T14:49:21+00:00\",\"description\":\"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain\",\"breadcrumb\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg\",\"width\":540,\"height\":181},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/newblog.siteground.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WP eCommerce Plugin Vulnerability Fixed\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"name\":\"SiteGround Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\",\"name\":\"SiteGround Blog\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"width\":1200,\"height\":400,\"caption\":\"SiteGround Blog\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/siteground\",\"https:\/\/x.com\/siteground\",\"https:\/\/www.instagram.com\/siteground\/\",\"https:\/\/www.youtube.com\/@siteground\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/380162a677d6c37329e9a12baa334572\",\"name\":\"Daniel Kanchev\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g\",\"caption\":\"Daniel Kanchev\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/daniel-kanchev-29716455\/\"],\"url\":\"https:\/\/newblog.siteground.com\/en\/author\/daniel\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"WP eCommerce Plugin Vulnerability Fixed : SiteGround Blog","description":"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"WP eCommerce Plugin Vulnerability Fixed","og_description":"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain","og_url":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/","og_site_name":"SiteGround","article_publisher":"https:\/\/www.facebook.com\/siteground","article_published_time":"2014-10-31T13:09:29+00:00","article_modified_time":"2025-09-18T14:49:21+00:00","og_image":[{"width":540,"height":181,"url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg","type":"image\/jpeg"}],"author":"Daniel Kanchev","twitter_card":"summary_large_image","twitter_creator":"@siteground","twitter_site":"@siteground","twitter_misc":{"Written by":"Daniel Kanchev","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#article","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/"},"author":{"name":"Daniel Kanchev","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/380162a677d6c37329e9a12baa334572"},"headline":"WP eCommerce Plugin Vulnerability Fixed","datePublished":"2014-10-31T13:09:29+00:00","dateModified":"2025-09-18T14:49:21+00:00","mainEntityOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/"},"wordCount":193,"commentCount":0,"publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2014\/10\/wpecommerce.jpg","articleSection":["Hosting Insights","Security","WordPress"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/","url":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/","name":"WP eCommerce Plugin Vulnerability Fixed : SiteGround Blog","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2014\/10\/wpecommerce.jpg","datePublished":"2014-10-31T13:09:29+00:00","dateModified":"2025-09-18T14:49:21+00:00","description":"Yesterday Sucuri reported a new vulnerability in WP eCommerce - a popular WordPress plugin for online stores. The vulnerability allows attackers to obtain","breadcrumb":{"@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#primaryimage","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2015\/09\/bash.jpg","width":540,"height":181},{"@type":"BreadcrumbList","@id":"https:\/\/newblog.siteground.com\/en\/wp-ecommerce-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/newblog.siteground.com\/en\/"},{"@type":"ListItem","position":2,"name":"WP eCommerce Plugin Vulnerability Fixed"}]},{"@type":"WebSite","@id":"https:\/\/newblog.siteground.com\/en\/#website","url":"https:\/\/newblog.siteground.com\/en\/","name":"SiteGround Blog","description":"","publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/newblog.siteground.com\/en\/#organization","name":"SiteGround Blog","url":"https:\/\/newblog.siteground.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","width":1200,"height":400,"caption":"SiteGround Blog"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/siteground","https:\/\/x.com\/siteground","https:\/\/www.instagram.com\/siteground\/","https:\/\/www.youtube.com\/@siteground"]},{"@type":"Person","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/380162a677d6c37329e9a12baa334572","name":"Daniel Kanchev","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g","caption":"Daniel Kanchev"},"sameAs":["https:\/\/www.linkedin.com\/in\/daniel-kanchev-29716455\/"],"url":"https:\/\/newblog.siteground.com\/en\/author\/daniel\/"}]}},"_links":{"self":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/7204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/users\/57"}],"replies":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/comments?post=7204"}],"version-history":[{"count":3,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/7204\/revisions"}],"predecessor-version":[{"id":19905,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/7204\/revisions\/19905"}],"wp:attachment":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/media?parent=7204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/categories?post=7204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/tags?post=7204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}