CVE-2026-81277: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in VillaTheme Suggestion Engine for WooCommerce

This vulnerability, identified as CWE-89, affects VillaTheme Suggestion Engine for WooCommerce versions up to 2.0.11. It arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact is a complete confidentiality breach and some availability loss, but no integrity impact. No vendor advisory or patch information is currently provided.

An attacker with low privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands remotely, potentially leading to full disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access privileges and monitoring for suspicious activity related to the Suggestion Engine for WooCommerce plugin. Avoid exposing the affected plugin to untrusted users.