CVE-2026-32580

HighCVSS 7.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

21th percentile - higher than 21% of all known CVEs

Summary

Unauthenticated SQL Injection in WooCommerce Lottery versions up to 2.2.9.

Risk Assessment

An attacker without authentication can execute unauthorized queries to the database, potentially leading to data leakage or modification.

Recommendation

Update the WooCommerce Lottery plugin to the latest version that includes the security fix.

Other vulnerabilities in WooCommerce Lottery

CVE-2026-18884High
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping and lack of preparation on the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones, allowing extraction of sensitive information from the database.

Original NVD description (English source)

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS