CVE-2026-57777: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Automattic WooCommerce

This vulnerability, identified as CWE-89, involves improper neutralization of special elements in SQL commands within Automattic WooCommerce, enabling blind SQL injection attacks. The flaw affects WooCommerce versions prior to 11.0. The CVSS 3.1 score is 7.6, indicating high severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive data. The vulnerability does not impact data integrity but may cause limited availability issues. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to SQL injection attempts.