Is CVE-2026-57777 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57777 being exploited in the wild.

How severe is CVE-2026-57777?

High severity, with a CVSS score of 7.6, published 4 September 2026.

Which products and versions are affected?

Automattic WooCommerce before 11.0.

Is there a fix for CVE-2026-57777?

A patch was published on 2026-08-10: Fix merged into release/11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57777 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57777?

Check whether you run Automattic WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57777: Automattic WooCommerce SQL injection in Analytics reports

CVE-2026-57777 · Severity: high · CVSS 7.6 · Published 2026-09-04

WooCommerce is an e-commerce plugin for WordPress used by online retailers to manage product catalogs, orders, and payments. A SQL injection vulnerability in the Analytics reports feature allows attackers to extract sensitive database information such as customer data, order details, and payment information through specially crafted requests. An attacker with access to the Analytics reports section could potentially read or manipulate the underlying database.

Technologies: Automattic WooCommerce. Vendors: Automattic.

Quick answers

Is CVE-2026-57777 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57777 being exploited in the wild.
How severe is CVE-2026-57777?: High severity, with a CVSS score of 7.6, published 4 September 2026.
Which products and versions are affected?: Automattic WooCommerce before 11.0.
Is there a fix for CVE-2026-57777?: A patch was published on 2026-08-10: Fix merged into release/11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57777 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57777?: Check whether you run Automattic WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a blind SQL injection flaw in the WooCommerce Analytics reports module, specifically affecting the woocommerce_date_type parameter. The vulnerable code fails to properly sanitize or parameterize user-supplied input before constructing SQL queries. An attacker with access to the Analytics reports functionality can inject arbitrary SQL code to extract data via time-based or boolean-based blind SQL injection techniques. The issue affects WooCommerce versions before 11.0, and a fix has been merged into the release/11.0 branch as of August 2026.

Affected products

Automattic WooCommerce before 11.0

Timeline

2026-09-04: disclosed
2026-08-10: patched: Fix merged into release/11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.