# CVE-2026-22335: WC Lovers WooCommerce Frontend Manager , Ultimate SQL injection

Source: https://junglewise.ai/threats/cve-2026-22335-wc-lovers-woocommerce-frontend-manager-ultimate-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-22335 · Severity: high · CVSS 8.5 · Published 2026-06-17

WooCommerce Frontend Manager – Ultimate is a WordPress plugin that provides an advanced dashboard for managing e-commerce stores. A security flaw allows logged-in users with basic 'Subscriber' permissions to execute unauthorized database commands. This could lead to the theft of sensitive customer data, site configuration details, or other information stored in the website's database.

Vendors: [WC Lovers](https://junglewise.ai/threats/vendors/wc-lovers).

## Quick answers

**Is CVE-2026-22335 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22335 being exploited in the wild.

**How severe is CVE-2026-22335?** High severity, with a CVSS score of 8.5, published 17 June 2026.

**Which products and versions are affected?** WC Lovers WooCommerce Frontend Manager – Ultimate < 6.7.7.

**Is there a fix for CVE-2026-22335?** A patch was published on 2026-06-17: Patch confirmed available in version 6.7.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22335 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22335?** Check whether you run WC Lovers WooCommerce Frontend Manager – Ultimate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the WooCommerce Frontend Manager – Ultimate plugin for WordPress in versions prior to 6.7.7. The flaw is caused by improper neutralization of user-supplied input in a component accessible to authenticated users. An attacker with 'Subscriber' level privileges can send specially crafted requests to the server to execute arbitrary SQL commands. This can be leveraged to bypass security controls and extract sensitive data from the WordPress database. The issue is resolved in version 6.7.7.

## Affected products

- WC Lovers WooCommerce Frontend Manager – Ultimate < 6.7.7

## Timeline

- 2025-10-09: other: Vulnerability reported by researcher 0xd4rk5id3
- 2026-01-15: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: CVE published and NVD record created
- 2026-06-17: patched: Patch confirmed available in version 6.7.7

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wc-frontend-manager-ultimate/vulnerability/wordpress-woocommerce-frontend-manager-ultimate-plugin-6-7-6-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wc-frontend-manager-ultimate/vulnerability/wordpress-woocommerce-frontend-manager-ultimate-plugin-6-7-6-sql-injection-vulnerability?_s_id=cve)