EUVD-2026-94286
GHSA-xjxc-jqcr-h283
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Network-reachable blind SQLi needing a high-privilege authenticated account (PR:H); confidentiality-only data disclosure (C:H), no integrity/availability impact and no cross-authority scope change, hence S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
AnalysisAI
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with HIGH privileges (PR:H) on the WordPress site - such as an administrator or WooCommerce shop manager account - and the Pix por Piggly (para WooCommerce) plugin installed at version 2.1.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a blind SQL injection (CWE-89) in the Pix por Piggly WooCommerce plugin (versions through 2.1.2), reported by Patchstack with a CVSS 3.1 score of 7.6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version was identified at time of analysis, and the published advisory does not yet name a remediated release, so administrators should first confirm the installed version of Pix por Piggly (para WooCommerce) and treat anything at or below 2.1.2 as vulnerable pending a vendor fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress installation running Pix por Piggly (para WooCommerce) at version 2.1.2 or earlier, confirm which accounts hold administrator or WooCommerce shop manager roles, deactivate the plugin on any internet-facing store that cannot justify that privileged population, and rotate credentials for those accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today