The WooCommerce Lottery plugin for WordPress has a time‑based SQL injection flaw that allows attackers to append malicious SQL through the 'orderby' and 'order' GET parameters. The input is not properly escaped and the query is executed without sufficient preparation, giving unauthenticated users the ability to run arbitrary SQL code. This can lead to extraction of sensitive database contents, including customer data and payment information, thereby compromising confidentiality and potentially the integrity of the store. The vulnerability is identified as CWE‑89 (SQL Injection).

Any WordPress site running the WooCommerce Lottery plugin version 2.2.9 or earlier is affected. The product is distributed by wpgenie. No information is available for later versions; updating to a newer release is required to eliminate the flaw.

The CVSS score of 7.5 indicates a high severity threat. While an EPSS score is unavailable, exploiting this injection requires no authentication and can be performed by simply sending crafted query strings to the site’s URLs. Because the flaw is in a third‑party plugin, the vulnerability can be used to gain unauthorized access to the database. The plugin is not listed in the CISA KEV catalog, but its high impact and ease of exploitation make it a priority to remediate. Monitoring for unusual database query patterns and potential injection attempts is advised until a patch is applied.