This vulnerability (CVE-2026-66631) is an improper neutralization of special elements used in an SQL command (CWE-89) in the MC Woocommerce Wishlist plugin developed by Moreconvert Team. It affects versions up to 1.9.21 and allows an administrator-level user to perform SQL Injection attacks. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality (high) and availability (low) with scope changed.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). There is no indication of integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor vendor communications for updates and consider restricting administrator access until a fix is available.