Executive brief
The WooCommerce Lottery plugin for WordPress is vulnerable to a SQL injection flaw that allows unauthenticated attackers to manipulate database queries through the 'orderby' and 'order' parameters. An attacker can exploit this to extract sensitive information from the WordPress database, such as customer data, order details, or other confidential information stored in the database.
Technical details
The vulnerability is a time-based SQL injection affecting the WooCommerce Lottery plugin due to insufficient escaping and lack of prepared statements on user-supplied GET parameters ('orderby' and 'order'). The vulnerable component is the entry list table functionality, which processes these parameters without proper sanitization before incorporating them into SQL queries. The attack vector is unauthenticated network access; no authentication is required. An attacker can craft malicious SQL payloads in the orderby and order parameters to perform time-based SQL injection attacks, allowing database extraction or potential data manipulation. The vulnerability affects all versions up to and including 2.2.9.
Affected products
- WooCommerce Lottery up to and including 2.2.9
Timeline
- 2026-08-26: disclosed