CVE-2026-57777

CVE-2026-57777 is a blind SQL injection flaw in WooCommerce, Automattic's e-commerce plugin for WordPress, caused by improper neutralization of special elements used in an SQL command (CWE-89). The vulnerability is network-reachable but requires the attacker to already hold a high-privilege account (CVSS privileges required: high), meaning privileged user input is passed into a SQL query without adequate sanitization. Successful exploitation enables blind extraction of database contents, with CVSS rating the confidentiality impact as high (and availability impact low), potentially exposing store, customer, and order data. Any WordPress site running WooCommerce in any version before 11.0 is affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

What to do: Update WooCommerce to 11.0 or later as soon as possible. Because exploitation requires a high-privilege account, audit administrator and shop-manager accounts, remove unnecessary privileged users, and review their recent activity for signs of data exfiltration; WAF rules that block common blind SQL injection patterns can serve as a temporary mitigation.