CVE-2026-32551: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in DiviNext Woo Essential

This vulnerability in DiviNext Woo Essential (up to version 4.3.0) is caused by improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It allows an attacker to execute arbitrary SQL commands remotely without authentication or user interaction. The CVSS 3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. No vendor advisory or patch information is available at this time.

An attacker can exploit this vulnerability to execute arbitrary SQL commands on the affected system remotely without authentication. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). The integrity impact is reported as none. The vulnerability is critical due to ease of exploitation and potential data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting external access to the affected application and monitoring for unusual database activity related to Woo Essential. Avoid exposing the vulnerable component to untrusted networks.