{"id":"CVE-2026-32580","published":"2026-10-06T09:17:43.780","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-lottery/vulnerability/wordpress-woocommerce-lottery-plugin-2-2-9-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in WooCommerce Lottery plugin versions up to 2.2.9, allowing unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This could lead to data theft, unauthorized access, or further compromise of the WordPress site.","exploitability":"Exploitation requires no authentication and is relatively straightforward, with attackers able to inject malicious SQL through vulnerable parameters in the plugin's API endpoints.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive customer data, manipulate lottery entries, or potentially gain access to the WordPress admin panel through database manipulation.","remediation":"Upgrade to WooCommerce Lottery version 2.3.0 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","woocommerce","e-commerce","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:12.012Z"}}