This vulnerability (CVE-2026-22335) involves improper neutralization of special elements used in SQL commands (CWE-89) within WooCommerce Frontend Manager – Ultimate. Specifically, subscriber-level users can exploit this SQL Injection flaw in versions before 6.7.7. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring privileges at the subscriber level, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation allows an attacker with subscriber privileges to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited service disruption (low availability impact). Integrity of data is not affected according to the CVSS vector. The vulnerability can be exploited remotely over the network with low complexity and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual database activity related to the WooCommerce Frontend Manager – Ultimate plugin. Avoid exposing the affected plugin to untrusted users.