CVE-2026-2579 is an SQL Injection vulnerability in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress, affecting all versions up to 4.4.3. The issue arises from improper neutralization of special elements in the 'search' parameter, allowing unauthenticated attackers to append malicious SQL queries. This vulnerability is due to insufficient escaping of user input and lack of prepared statements in the SQL query construction, enabling potential unauthorized data extraction from the database. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to perform SQL Injection via the 'search' parameter, potentially extracting sensitive information from the backend database. The vulnerability does not impact integrity or availability directly but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected plugin functionality if possible and monitor for updates from the vendor. Avoid using vulnerable versions of the plugin in production environments.