{"id":"CVE-2026-42714","published":"2026-10-07T11:17:19.237","lastModified":"2026-10-07T18:17:20.640","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pix-por-piggly/vulnerability/wordpress-pix-por-piggly-para-woocommerce-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Pix por Piggly plugin for WooCommerce, potentially enabling them to extract sensitive data from the database without proper authentication. The flaw occurs due to improper neutralization of special elements in SQL commands.","exploitability":"Exploitation requires a high-privilege user account (PR:H) and involves crafting specific SQL payloads that can be executed through the plugin's input handling, making it moderately difficult to exploit without prior access to an authenticated session.","blast_radius":"If exploited, this blind SQL injection could allow attackers to extract sensitive customer data, payment information, and administrative credentials from the WooCommerce store's database, potentially leading to full system compromise.","remediation":"Upgrade to version 2.1.3 or later to address the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","woocommerce","e-commerce","blind-sql"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:01:17.355Z"}}