Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL… (CVE-2026-57777)

CVE-2026-57777 is a SQL Injection vulnerability in Automattic WooCommerce caused by improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. The vulnerability affects WooCommerce versions prior to 11.0. The CVSS 3.1 score is 7.6, indicating high severity with network attack vector, low attack complexity, requiring high privileges, no user interaction, and scope changed. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No official patch or remediation details are provided in the available data.

An attacker with high privileges can exploit this vulnerability remotely to perform Blind SQL Injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no reported impact on data integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Automattic WooCommerce advisories for updates. Until a fix is available, restricting high privilege access and minimizing exposure of vulnerable WooCommerce instances may reduce risk.