CVE-2026-87770 describes a SQL injection vulnerability in the Price Drop Alert for Woo Commerce WordPress plugin versions up to 1.1. The vulnerability exists because parameters used in a SQL query on an AJAX action are not properly sanitized or escaped. This AJAX action is accessible to unauthenticated users, enabling remote attackers to inject malicious SQL code and extract sensitive information from the backend database.

Unauthenticated attackers can exploit this vulnerability to perform SQL injection attacks, which may lead to unauthorized disclosure of sensitive data stored in the database. The exact scope of data exposure depends on the database contents and the attacker's capabilities. There is no indication of active exploitation in the wild at this time.

No patch or official fix information is currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling or restricting access to the vulnerable AJAX functionality if possible to reduce exposure.