Escape statuses for sql query

Co-authored-by: Thomas Roberts <[email protected]>
woocommerce · Aug 20, 2021 · e7bd0e6 · e7bd0e6
1 parent 29c8493
commit e7bd0e6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/StoreApi/Utilities/ProductQueryFilters.php b/src/StoreApi/Utilities/ProductQueryFilters.php
@@ -102,7 +102,7 @@ private function generate_stock_status_count_query( $status, $product_query_sql,
 			return false;
 		}
 		global $wpdb;
-
+		$status = esc_sql( $status );
 		return "
 			SELECT COUNT( DISTINCT posts.ID ) as status_count
 			FROM {$wpdb->posts} as posts