Escape statuses for sql query

Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
woocommerce · Aug 20, 2021 · 8012b2b · 8012b2b
1 parent 304348a
commit 8012b2b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/StoreApi/Utilities/ProductQueryFilters.php b/src/StoreApi/Utilities/ProductQueryFilters.php
@@ -102,7 +102,7 @@ private function generate_stock_status_count_query( $status, $product_query_sql,
 			return false;
 		}
 		global $wpdb;
-
+		$status = esc_sql( $status );
 		return "
 			SELECT COUNT( DISTINCT posts.ID ) as status_count
 			FROM {$wpdb->posts} as posts