The flaw is an unauthenticated SQL Injection in the WordPress WooCommerce Lottery plugin version 2.2.9 and earlier. By injecting malicious SQL into plugin input fields, an attacker can execute arbitrary database commands, read sensitive data, or modify records. The vulnerability arises from insufficient input sanitization and missing parameterization, classified as CWE‑89. This can lead to data exfiltration, credential theft, or manipulation of transactional data within the WooCommerce environment.

The vulnerability affects the WooCommerce Lottery plugin from vendor wpgenie. All installations running version 2.2.9 or lower are potentially exposed.

With a CVSS score of 7.5, the flaw is high severity. EPSS score is less than 1%, indicating a very low exploitation probability; however, the lack of authentication and client‑side protection means any user can attempt to exploit the plugin. The vulnerability is not listed in CISA’s KEV catalog, but the potential impact on sensitive e‑commerce data warrants prompt attention. Based on the description, it is inferred that an attacker can likely reach the vulnerable endpoint through publicly accessible URLs or embedded forms, making the attack vector reachable without privileged credentials.