Summary
Advatix FEP API Connection through 2.5.18 registers a REST order-update callback without a permission_callback. User-controlled order and tracking fields from the JSON body are concatenated into a SQL SELECT. A site-key header check is skipped when the header is absent, so the route is reachable without a WordPress login. Local timing tests showed a blind SQL-injection oracle on the SELECT path. The same unauthenticated callback can also change WooCommerce order status, write shipment tracking rows, and return full order data to the caller. A related inventory-update route lacked a permission_callback in code review but was not exercised in the test.
Impact
An unauthenticated remote caller can obtain a blind SQL-injection oracle against the site database, read order data returned by the callback, and modify order status and tracking records. That combination risks disclosure of order and customer-related data and unauthorized changes to fulfilment state.
Remediation
Pass dynamic SQL values through prepared statements. Add a permission_callback on every REST route that changes orders or stock, and reject callers who lack the required capability. Require a secret site-key on every request, store it as a configured secret, and compare it with a constant-time equality check — do not derive it from the public host name.
Why no CVE
No public CVE identifier has been assigned yet. The issue was reported through coordinated disclosure channels; this record documents the product, versions, root cause and impact without publishing exploit material.