WooCommerce CVE-2026-57777

Exploitation requires a valid WooCommerce admin or shop manager account (PR:H per CVSS), as the vulnerable Analytics REST API endpoints are restricted to authenticated high-privilege users. The date_type query argument injection path is present in the Orders Stats DataStore and is reachable via the /wp-json/wc-analytics/ REST API. The woocommerce_date_type WordPress option injection path requires the attacker to write to WordPress options, which also requires admin-level access. No special plugin configuration or non-default setting beyond having WooCommerce installed and the Analytics module active (enabled by default) is required. Exploitation is limited by the PR:H requirement: unauthenticated or subscriber-level users cannot reach the vulnerable code paths.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L yields a 7.6 base score. PR:H is the dominant risk-limiting factor - exploitation requires admin or shop manager credentials, substantially narrowing the attacker population to insiders, compromised admin accounts, or situations where privilege escalation has already occurred. The scope change (S:C) and C:H reflect that blind SQLi against a WordPress database can reach tables outside WooCommerce's intended scope, including wp_users hashed passwords and plugin-stored secrets. The A:L component is consistent with heavy blind-query traffic potentially degrading database performance. No KEV listing and no public exploit identified at time of analysis, and the EPSS signal is not provided; however, Patchstack disclosure of WooCommerce flaws historically attracts rapid proof-of-concept development given the platform's scale. The net real-world priority is moderate-to-high for stores with exposed Analytics APIs and where admin credential compromise is a plausible threat path.

An attacker with WooCommerce admin or shop manager credentials sends a crafted REST API request to the Analytics Orders Stats endpoint, supplying a malicious date_type parameter value such as a SQL expression instead of a valid column name. Because the value is interpolated unsanitized into the SQL query, the attacker uses boolean-based blind injection to iteratively extract the wp_users table, recovering administrator password hashes for offline cracking or other sensitive data.