Is CVE-2026-66631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66631 being exploited in the wild.

How severe is CVE-2026-66631?

High severity, with a CVSS score of 7.6, published 17 September 2026.

Which products and versions are affected?

MC Woocommerce Wishlist <= 1.9.21.

Is there a fix for CVE-2026-66631?

A patch was published on 2026-09-17: Fix available in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66631 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66631?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66631: MC Woocommerce Wishlist SQL injection

Q: Is there a fix for CVE-2026-66631?

A patch was published on 2026-09-17: Fix available in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66631 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-66631?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66631 · Severity: high · CVSS 7.6 · Published 2026-09-17

MC Woocommerce Wishlist is a WordPress plugin that allows customers to create and manage product wishlists. A SQL injection vulnerability in versions 1.9.21 and earlier allows administrators with access to the plugin's admin functions to execute arbitrary database queries, potentially exposing, modifying, or deleting sensitive customer data and WordPress configuration.

Quick answers

Is CVE-2026-66631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66631 being exploited in the wild.
How severe is CVE-2026-66631?: High severity, with a CVSS score of 7.6, published 17 September 2026.
Which products and versions are affected?: MC Woocommerce Wishlist <= 1.9.21.
Is there a fix for CVE-2026-66631?: A patch was published on 2026-09-17: Fix available in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66631 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66631?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a SQL injection flaw that permits an authenticated administrator to inject malicious SQL code through an unvalidated input parameter. The vulnerability requires administrator-level privileges to exploit and is classified as CWE-89 (SQL Injection). An attacker with admin access can manipulate database queries to read, modify, or delete records—including user accounts, customer orders, and private data. The patch is available in version 2.0.0, and affected deployments should update immediately.

Affected products

MC Woocommerce Wishlist <= 1.9.21

Timeline

2026-09-17: disclosed: Published by Patchstack
2026-09-17: patched: Fix available in version 2.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.