WooCommerce Lottery CVE-2026-18884

The WooCommerce Lottery plugin by WPGenie must be installed and active on a WordPress/WooCommerce site at version 2.2.9 or earlier. The vulnerable surface is the publicly accessible lottery entry list page, which processes 'orderby' and 'order' as unsanitized GET parameters - no authentication, no special plugin configuration, no administrative setup, and no victim user interaction is required, consistent with the CVSS:3.1/PR:N/UI:N vector. Exploitation is limited to database read operations (confidentiality impact only); the available description does not indicate that the injection point enables write access or command execution. Sites where lottery public pages are behind authentication walls, IP restrictions, or WAF rules blocking SQLi patterns in GET parameters are materially less exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yielding a 7.5 base score accurately reflects the vulnerability's characteristics: unauthenticated, network-accessible, low-complexity exploitation with high confidentiality impact and no integrity or availability impact. The bounded I:N and A:N scores are consistent with a read-only injection point, and no conflicts exist between the CVSS vector and the description. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed in-the-wild exploitation at time of analysis. Despite the absence of KEV listing, the attack is fully automatable with widely available tooling - sqlmap can enumerate blind injection targets with minimal operator skill - meaning even a mid-sized e-commerce operator in leszno should treat this as urgent if the affected plugin version is active. The WordPress database typically holds hashed user passwords, customer PII, WooCommerce order details, and session tokens, making the potential blast radius of a successful extraction significant. Overall, this is a genuine priority for any site running the affected plugin, not a paper-severity finding inflated by CVSS alone.

An unauthenticated attacker runs an automated scanner that identifies WordPress sites with the WooCommerce Lottery plugin installed via its known URL patterns or asset fingerprints. The attacker passes a crafted payload such as 'orderby=id AND SLEEP(5)--' to the public lottery entry list page and confirms injection by observing a five-second response delay. Using sqlmap or a custom script, the attacker then iterates through the database schema, extracting the wp_users table - including hashed passwords and email addresses - along with WooCommerce order and customer records, all without triggering any authentication challenge. No public exploit code has been identified at time of analysis, but the time-based technique is well-documented and the tooling is freely available.