What is the CVSS score of CVE-2026-22335?

CVE-2026-22335 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WooCommerce Frontend Manager Ultimate are affected by CVE-2026-22335?

The WooCommerce Frontend Manager plugin (versions before 6.7.7) contains a SQL injection vulnerability allowing authenticated subscriber-level users to access or modify customer databases on affected…. A patch is available.

How to fix or mitigate CVE-2026-22335?

Within 24 hours: Identify all WordPress instances running WooCommerce Frontend Manager; document installed versions and disable the plugin if operationally feasible. Within 7 days: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns in plugin input fields; restrict subscriber role creation to essential users only. Within 30 days: Monitor vendor security advisory channels for patch release targeting version 6.7.7 or later; establish change control testing procedure and deploy update immediately upon availability.

WooCommerce Frontend Manager Ultimate CVE-2026-22335

EUVD-2026-37657 HIGH

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Woocommerce Frontend Manager Ultimate Wc Lovers

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint, only Subscriber auth required (PR:L), no user interaction; SQLi reaches shared DB (S:C) yielding high confidentiality, no integrity per advisory, low availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:16 EUVD

Analysis Generated

Jun 17, 2026 - 12:31 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in WooCommerce Frontend Manager - Ultimate < 6.7.7 versions.

AnalysisAI

SQL injection in the WooCommerce Frontend Manager - Ultimate WordPress plugin (versions prior to 6.7.7) allows authenticated subscriber-level users to inject SQL via plugin-handled input, exposing database contents and enabling limited data tampering on affected WooCommerce sites. The CVSS 8.5 rating reflects a scope change reaching the underlying database with high confidentiality impact. No public exploit identified at time of analysis.

Technical ContextAI

The affected component is the WC Lovers 'WooCommerce Frontend Manager - Ultimate' premium add-on (CPE cpe:2.3:a:wc_lovers.:woocommerce_frontend_manager_-_ultimate), which extends WooCommerce by giving vendors and customers frontend dashboards for orders, products, and account management. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into a SQL query handled by WordPress's $wpdb layer without proper parameterization or sanitization through prepare()/esc_sql(). Because WordPress shares a single MySQL/MariaDB database across core, plugins, and users, a successful injection can reach the wp_users and wp_options tables far beyond the plugin's own scope - which is consistent with the CVSS Scope:Changed flag.

RemediationAI

Patch available per vendor advisory - upgrade the WooCommerce Frontend Manager - Ultimate plugin to version 6.7.7 or later via the WordPress admin Plugins screen or by replacing the plugin directory from WC Lovers, then verify the running version under Plugins > Installed Plugins; see the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wc-frontend-manager-ultimate/vulnerability/wordpress-woocommerce-frontend-manager-ultimate-plugin-6-7-6-sql-injection-vulnerability for confirmation. If immediate patching is not possible, compensating controls include temporarily disabling open customer registration on the WooCommerce store (Settings > Accounts & Privacy, uncheck 'Allow customers to create an account during checkout' and 'Allow customers to create an account on the My account page'), which removes the trivial Subscriber-acquisition path at the cost of breaking guest-to-account conversion, or placing a WAF rule (e.g., Patchstack vPatch, Wordfence) that blocks SQL meta-characters on the plugin's frontend AJAX/REST endpoints, with the trade-off of potential false positives on legitimate vendor inputs. Deactivating the plugin entirely eliminates risk but disables frontend vendor/customer dashboards.