WooCommerce Polylang Integration CVE-2026-101926

Exploitation requires an authenticated WordPress account with at least Subscriber-level privileges (CVSS PR:L) and that the vulnerable Hyyan WooCommerce Polylang Integration plugin (version ≤1.5.0) be installed and active, since the attack targets its specific 'woocommerce_remove_variations' AJAX handler via the 'variation_ids' parameter. No user interaction is needed (UI:N) and the request is network-reachable (AV:N). The practical limiting factor is the Subscriber credential requirement; however, on stores permitting customer/self-registration (typical for WooCommerce) this barrier is minimal, materially increasing real-world exposure. Impact is limited to read/exfiltration of database contents (C:H, I:N, A:N) - the flaw does not by itself grant data modification or site takeover.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) shows a network-reachable, low-complexity SQL injection requiring only low privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with the description's claim of data extraction by authenticated Subscriber-level users. The key limiting signal is PR:L: exploitation requires an authenticated account, so this is most dangerous on sites allowing open/self-registration (common for WooCommerce stores), where Subscriber accounts are trivially obtained, effectively lowering the bar toward unauthenticated. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public POC is indicated in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The references point to specific vulnerable source lines (Variation.php and Variable.php) in the WordPress plugin repository, confirming the code-level root cause via Wordfence. Net: a real, confirmed confidentiality risk that warrants patching, but the authentication requirement and absence of exploitation/EPSS signals keep it below critical urgency.

An attacker registers or obtains a Subscriber-level account on a WooCommerce store running the vulnerable plugin, then issues the 'woocommerce_remove_variations' AJAX request with a crafted 'variation_ids' value that appends a UNION/sub-query to the unprepared SQL statement. The injected query extracts sensitive database contents such as password hashes, secret keys, or customer data. No public proof-of-concept is indicated in the available data, but the injection point is low-complexity and the vulnerable source lines are publicly identified.