High · 7.6 CVE-2026-57777 EUVD-2026-70971GHSA-cw46-936q-fjcf

WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Published Sep 4, 2026 · Updated Sep 4, 2026 · Assigned by Patchstack

Vendor: Automattic Product: WooCommerce Category: Web / CMS

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection.

This issue affects WooCommerce: from n/a before 11.0.

Affected products

Vendor	Product	Affected	Fixed
Automattic	WooCommerce	< 11.0	11.0

References

https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-10-9-4-sql-injection-vulnerability?_s_id=cve vdb-entry
https://github.com/woocommerce/woocommerce/pull/67554 issue-tracking patch