CVE-2026-32580: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpgenie WooCommerce Lottery

This vulnerability (CVE-2026-32580) is an SQL Injection flaw classified under CWE-89 in the WooCommerce Lottery plugin for WordPress, specifically in versions up to 2.2.9. It allows unauthenticated attackers to inject special SQL elements, which can compromise the confidentiality of the database and cause partial denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and may cause limited disruption to availability (low availability impact). Integrity impact is not indicated. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected plugin or disabling it may reduce risk.