CVE-2026-42714

Summary

This vulnerability allows attackers to perform blind SQL injection attacks against the Pix por Piggly plugin for WooCommerce, potentially enabling them to extract sensitive data from the database without proper authentication. The flaw occurs due to improper neutralization of special elements in SQL commands.

Exploitability

Exploitation requires a high-privilege user account (PR:H) and involves crafting specific SQL payloads that can be executed through the plugin's input handling, making it moderately difficult to exploit without prior access to an authenticated session.

Blast radius

If exploited, this blind SQL injection could allow attackers to extract sensitive customer data, payment information, and administrative credentials from the WooCommerce store's database, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.1.3 or later to address the SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.