CVE-2026-32551 is an unauthenticated SQL Injection vulnerability in DiviNext's Woo Essential plugin, affecting versions up to 4.3.0. The vulnerability allows attackers to inject malicious SQL commands remotely without requiring any privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction needed, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No patch or official remediation level has been published by the vendor as of the provided data.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to high confidentiality impact. The vulnerability does not affect data integrity but may cause limited availability issues. Since it is unauthenticated and remotely exploitable, it poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying virtual patching or web application firewall (WAF) rules to detect and block SQL injection attempts targeting Woo Essential plugin endpoints.