Square for WooCommerce CVE-2026-57810

Exploitation requires a low-privileged authenticated session on the target WordPress site (CVSS PR:L), so the attacker must first hold or acquire valid credentials - commonly achievable where WooCommerce/WordPress self-service customer or subscriber registration is enabled. The specific vulnerable parameter/endpoint is not detailed in the available data (the description states only 'Blind SQL Injection' through woosquare <= 4.7.4). Limiting factors: the requirement for authentication (no anonymous exploitation), the need for the woosquare plugin to be installed and active, and the blind nature of the injection which makes data exfiltration slower and noisier (many requests, potential time-based delays) than an in-band SQLi.

The signals are moderately concerning but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates network-reachable, low-complexity exploitation with no user interaction, but it explicitly requires low-level privileges (PR:L), so an authenticated foothold is a prerequisite - this meaningfully reduces the practical attack surface compared to a PR:N pre-auth SQLi. The vendor rates confidentiality High and includes a scope change (S:C), which drives the elevated score; the S:C and A:L choices are debatable for a classic blind SQLi and should be treated with caution. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; there is no KEV listing and no POC referenced, so this is not confirmed to be under active exploitation. Net: a real, patch-worthy issue for exposed WooCommerce stores where low-privilege accounts (e.g., customer/subscriber registration) are enabled, but priority sits below unauthenticated or actively-exploited SQLi.

An attacker registers or obtains a low-privilege account on a WooCommerce store running woosquare <= 4.7.4, then sends crafted HTTP requests to a vulnerable plugin endpoint with SQL metacharacters embedded in a parameter. Because the injection is blind, the attacker uses boolean or time-based conditions to iteratively extract sensitive data such as user credentials, order details, and secret keys from the WordPress database. No public POC is referenced in the available data, but the low attack complexity makes exploitation straightforward once authenticated.