CVE-2026-19778 describes a time-based SQL Injection vulnerability (CWE-89) in the WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress. The vulnerability exists in the 'feed' parameter, which is not properly escaped or prepared in SQL queries. Authenticated attackers with administrator or higher privileges can exploit this to append malicious SQL commands, potentially extracting sensitive database information. The vulnerability affects all versions up to and including 2.23.7. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an authenticated administrator-level user to perform SQL Injection attacks that can extract sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but it has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator-level access to trusted users only and monitor for suspicious activity related to the 'feed' parameter. Avoid using affected versions if possible.