CVE-2026-18884: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpgenie WooCommerce Lottery

CVE-2026-18884 describes a Time-Based SQL Injection vulnerability in the WooCommerce Lottery WordPress plugin by wpgenie. The vulnerability arises from insufficient escaping and lack of proper preparation of user-supplied 'orderby' and 'order' GET parameters in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 2.2.9. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected parameters or employing web application firewall rules to detect and block SQL injection attempts targeting these parameters.