CVE-2026-66631

The MC Woocommerce Wishlist plugin in versions up to and including 1.9.21 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

An administrator or an attacker with a compromised administrator account could execute arbitrary SQL queries, risking data leakage, modification, or deletion from the WordPress database.

Update the MC Woocommerce Wishlist plugin to a version newer than 1.9.21 as soon as a fix is available, and apply the principle of least privilege to administrative accounts.