WooCommerce Lottery CVE-2026-32580

Exploitation requires the WooCommerce Lottery plugin (WPGenie) version 2.2.9 or earlier installed and active on a WordPress site, which in turn requires the WooCommerce platform to be present. No authentication is required (PR:N) and no user interaction (UI:N), so any remote actor who can reach the vulnerable lottery endpoint can attempt it. LIMITING FACTORS: the attack surface is confined to sites that deploy this specific niche paid add-on; the vendor-assigned AC:H indicates the attack is not trivially repeatable and may depend on specific conditions, timing, or data states at the injection point, which the advisory does not fully enumerate.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L, base 7.5) describes a network-reachable, unauthenticated flaw, which normally raises urgency, but the vendor-assigned AC:H (high attack complexity) tempers it by implying exploitation is not trivially repeatable - unusual for a classic SQL injection, which is typically AC:L. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or imminent mass exploitation at this time. The S:C (scope changed) and C:H with I:N/A:L profile suggests the vendor assessed this as primarily a confidentiality/data-disclosure issue reaching beyond the plugin's own data, rather than full database takeover. CONFLICTING SIGNAL: a CWE-89 unauthenticated SQL injection would normally warrant AC:L and higher integrity impact, yet the input rates AC:H with I:N - verify the exact injection point and whether it is blind/read-only with the Patchstack advisory. Overall: a credible, patch-worthy vulnerability in a niche e-commerce add-on, but absent EPSS/KEV/POC data it reads as high-CVSS with currently unproven real-world exploitation.

An unauthenticated attacker locates a WordPress store running WooCommerce Lottery 2.2.9 or earlier and sends a crafted HTTP request to the vulnerable lottery endpoint containing a malicious SQL payload. Because input is not sanitized before reaching a database query (CWE-89), the attacker extracts sensitive data such as customer records, order details, or WordPress credential hashes. No public exploit code was identified in the provided data, and the vendor's AC:H rating implies some non-trivial preconditions must be met.