Description
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Published: 2026-09-18
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Breach
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in the Price Drop Alert for Woo Commerce WordPress plugin version 1.1. An AJAX action available to any visitor does not escape or sanitize incoming parameters before incorporating them into a SQL query. This flaw permits an unauthenticated attacker to inject arbitrary SQL, enabling extraction of sensitive database contents such as user credentials, order information, and other confidential data.

Affected Systems

The affected product is the Price Drop Alert for Woo Commerce plugin for WordPress, any installation of version 1.1 or earlier. No other vendor or product variants are listed.

Risk and Exploitability

The CVSS score of 8.6 classifies this as a high‑severity issue, yet the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog, but the attack vector is straightforward: a web application call to an unsecured AJAX endpoint. An attacker can execute the injection from any IP address without authentication, revealing sensitive data and potentially allowing further compromise.

Generated by OpenCVE AI on September 19, 2026 at 19:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Price Drop Alert for Woo Commerce plugin to version 1.2 or later, which implements proper input validation for the vulnerable AJAX endpoint.
  • Restrict access to the affected AJAX action by requiring a valid WordPress user role before processing any parameters, thereby preventing unauthenticated use.
  • Apply a server‑side request filter or web‑application firewall rule that blocks the SQL injection patterns used against the plugin’s database queries, providing a temporary defensive layer until the plugin is updated.

Generated by OpenCVE AI on September 19, 2026 at 19:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions price Drop Alert For Woo Commerce
Vendors & Products Wordpress-extensions
Wordpress-extensions price Drop Alert For Woo Commerce

Fri, 18 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Title Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
References

Subscriptions

Wordpress-extensions Price Drop Alert For Woo Commerce
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-18T11:10:41.486Z

Reserved: 2026-09-09T08:19:28.857Z

Link: CVE-2026-87770

cve-icon Vulnrichment

Updated: 2026-09-18T11:03:00.705Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T06:16:40.410

Modified: 2026-09-18T19:08:32.830

Link: CVE-2026-87770

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T13:21:51Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')