CVE-2026-2232 is a time-based SQL Injection vulnerability in the Product Table and List Builder for WooCommerce Lite plugin for WordPress, affecting all versions up to and including 4.6.2. The issue arises from improper neutralization of special elements in the 'search' parameter, allowing unauthenticated attackers to append SQL queries to existing database queries. This vulnerability is classified under CWE-89 and has a CVSS v3.1 score of 7.5, indicating high severity. The plugin is not a cloud service, and no patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality by enabling data extraction through SQL Injection. The attack requires no privileges or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin, especially the 'search' functionality, to mitigate risk. Monitoring for unusual database queries may help detect exploitation attempts. Avoid exposing the affected parameter to untrusted users.