CVE-2026-32580

Summary

A SQL injection vulnerability exists in WooCommerce Lottery plugin versions up to 2.2.9, allowing unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This could lead to data theft, unauthorized access, or further compromise of the WordPress site.

Exploitability

Exploitation requires no authentication and is relatively straightforward, with attackers able to inject malicious SQL through vulnerable parameters in the plugin's API endpoints.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive customer data, manipulate lottery entries, or potentially gain access to the WordPress admin panel through database manipulation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WooCommerce Lottery version 2.3.0 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.