rootpwn

critical · CVSS v3 9.8

CVE-2026-87770

The WooCommerce Price Drop Alert plugin (v1.1) contains an unauthenticated SQL injection vulnerability in an AJAX action. Attackers can inje

Overview

The WooCommerce Price Drop Alert plugin (v1.1) contains an unauthenticated SQL injection vulnerability in an AJAX action. Attackers can inject SQL to read or modify database contents. This flaw allows extraction of sensitive data from WordPress sites.

Description

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Impact

Confidentiality is compromised as attackers can read private data, integrity is threatened by potential data modification, and availability may be impacted if the database is corrupted. Site owners, administrators, and end‑users are directly affected.

Remediation

Update the plugin to the latest version (>=1.2) where the input is properly sanitized. If an update is not possible, disable the vulnerable AJAX endpoint or restrict it to authenticated users. Additionally, enforce least‑privilege database access and consider a WAF rule to block suspicious SQL patterns.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation. No EPSS data is available, but the severity alone warrants immediate action.

Affected products

  • WooCommerce Price Drop Alert
  • WordPress

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

sql-injection wordpress plugin unauthenticated critical

← All CVEs

Related CVEs

critical

CVE-2026-93467

CVE-2026-93467 is an insecure deserialization flaw in OAKlouds by HGiga. Unauthenticated attackers can send crafted data to trigger arbitrary code execution on the server, allowing full compromise of the affected services.

View analysis

critical

CVE-2026-17086

The ShortPixel Image Optimizer plugin for WordPress contains a PHP Object Injection vulnerability in versions up to and including 6.5.5. It arises from the unsafe deserialization of untrusted input accessible to authenticated users with author-level privileges and above. While no native POP chain exists in the plugin itself, the presence of a compatible gadget chain from another theme or plugin could enable arbitrary file deletion, data retrieval, or code execution.

View analysis

critical

CVE-2026-81810

The All-in-One WP Migration and Backup plugin for WordPress fails to enforce proper capability checks on multiple AJAX actions. This oversight allows users with export privileges to import arbitrary site archives and escalate privileges to administrator under specific misconfigurations.

View analysis

critical

CVE-2026-85123

The Easy Form Builder plugin for WordPress fails to properly validate submitted values against stored configurations for certain form types. This oversight allows unauthenticated attackers to create unauthorized WordPress accounts on target sites where user registration has been explicitly disabled by the administrator. The flaw undermines core site access controls and exposes the installation to potential administrative takeover.

View analysis