Suggestion Engine WooCommerce CVE-2026-81277

Exploitation requires the attacker to hold at least contributor-level authentication on the WordPress installation, as confirmed by the CVSS PR:L metric. The Suggestion Engine for WooCommerce plugin must be installed and active at version 2.0.11 or earlier, with WooCommerce also present and active. The CVSS integrity impact of N (no integrity change) indicates the injection is constrained to read operations - write, update, or delete exploitation is not confirmed by available data. Sites that disable public user registration or restrict contributor account creation significantly reduce external exposure. The scope change (S:C) means the attacker can read data from tables beyond the plugin's own schema, expanding the potential data loss surface to the full WordPress database. No specific non-default configuration is required beyond having the plugin active - any installation at the affected version with a reachable contributor account is potentially exploitable.

The CVSS 8.5 High score is driven by network reachability (AV:N), low attack complexity (AC:L), only contributor-level authentication required (PR:L), no user interaction (UI:N), scope change (S:C), and high confidentiality impact (C:H). The I:N and A:L ratings temper the overall score slightly, suggesting the injection is exploitable for data extraction rather than data manipulation or denial of service. No EPSS data was supplied, so probabilistic exploitation likelihood cannot be quantified; however, SQL injection against low-privilege roles in WordPress plugins is a well-understood, widely-exploited attack class with abundant tooling. The absence of a KEV listing and confirmed POC means no active campaign is currently confirmed, but this does not negate the structural risk. Sites with open contributor registration (common in community or review-driven WooCommerce stores) face materially higher exposure. The read-only nature limits the worst-case impact to data exfiltration rather than site takeover or ransomware staging - but full database read still exposes hashed passwords and PII.

An attacker registers a free contributor account on a WooCommerce storefront running the vulnerable plugin, or compromises an existing contributor's credentials through credential stuffing. They then send a crafted HTTP request to the plugin's suggestion engine endpoint - for example, a product autocomplete or search suggestion handler - embedding a SQL UNION or blind injection payload in a user-controlled parameter. The injected query escapes the plugin's table scope and returns sensitive WordPress database contents, including wp_users password hashes and wp_woocommerce_order tables, without triggering any integrity-altering operations.