License Manager WooCommerce EUVD-2026-60775

Exploitation requires a valid WooCommerce customer account on the target store - any user who has self-registered or completed a guest checkout qualifies, making the prerequisite very low on stores with open registration. The CVSS AC:H rating indicates an additional complexity factor beyond authentication: likely a specific parameter, request structure, or multi-step workflow state that must be satisfied, which the available advisory does not detail. Exploitation is limited by: (1) mandatory customer-level authenticated session - fully unauthenticated exploitation is not indicated by the PR:L vector; (2) AC:H complexity suggesting the injectable path is not trivially discoverable without source-code analysis or targeted fuzzing; (3) the vendor-assigned I:N suggests the injection may be read-only in the identified exploitation path, limiting write-side impact. Stores that have disabled customer self-registration, require manual account approval, or operate in B2B-only models with tightly controlled customer lists face meaningfully reduced exposure.

The CVSS 7.1 High rating reflects the combination of high confidentiality impact, scope change, and network accessibility, partially mitigated by AC:H and PR:L. Real-world risk is moderate-to-high: WooCommerce stores routinely permit open customer registration, meaning attackers can self-provision the required authenticated session without prior relationship with the target. The AC:H rating is the primary risk-reducing factor, suggesting a non-trivial exploitation path - possibly a specific parameter, workflow state, or multi-step request sequence - that prevents simple automated scanning. However, AC:H should not be interpreted as a strong protection: motivated attackers with source-code access (the plugin is publicly available) can perform static analysis to identify the exact injectable parameter. No EPSS data was provided, KEV is absent, and no public POC has been identified - signals consistent with nascent exploitation risk that will likely increase post-disclosure. The C:H/S:C combination is the most severe aspect: successful exploitation could expose the entire WordPress database, representing a data breach scenario rather than a mere application-layer bypass. I:N in the vendor vector is conservative and may understate risk if the injectable query permits DML operations.

A threat actor registers a standard customer account on a WooCommerce store running License Manager for WooCommerce ≤ 3.0.18, then submits a crafted HTTP request - likely targeting a license lookup, activation check, or order-history endpoint - with a malicious SQL fragment embedded in a query parameter or POST field. The unsanitized input is incorporated into a database query, enabling UNION-based or blind enumeration of the WordPress database: the attacker extracts license keys, customer email addresses, order details, and wp_users password hashes. No public POC exists at time of analysis, but the attack technique is well-understood and patch-diff inspection of the fixed plugin version would readily expose the injectable parameter.