This vulnerability (CVE-2026-59537) is an SQL Injection issue classified under CWE-89 in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin. It affects versions up to and including 2.10.22. An authenticated administrator can exploit improper neutralization of special elements in SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The CVSS v3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and scope change. No official patch or remediation level has been published, and no known exploits have been observed in the wild.

Successful exploitation allows an authenticated administrator to perform SQL Injection attacks, resulting in high confidentiality impact (unauthorized data disclosure) and low availability impact (partial service disruption). There is no indicated impact on data integrity. The vulnerability requires high privileges and network access, limiting the attack surface to authorized administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for unusual database activity. Avoid exposing administrative interfaces to untrusted networks.