YITH Membership Premium EUVD-2026-62372

Exploitation requires a valid WordPress subscriber-level account on the target site. Subscriber is the lowest registered user role in WordPress and is typically granted automatically upon site registration - meaning any site with open user registration or a WooCommerce membership purchase flow is exposed to unauthenticated-to-subscriber escalation followed by this SQLi. The CVSS vector (PR:L) confirms a low-privilege authenticated account is sufficient; no administrative or editor access is required. Exploitation is limited to WordPress sites running YITH WooCommerce Membership Premium at version 2.33.0 or below; sites that have disabled user registration and have no mechanism for external parties to obtain subscriber accounts face meaningfully reduced risk, but are not immune if any subscriber accounts exist.

The CVSS 8.5 base score is substantiated by a credible combination of signals: network-reachable attack vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), a scope change affecting the database tier (S:C), and high confidentiality impact (C:H). The low privilege bar - a mere subscriber account - significantly elevates real-world risk because subscriber accounts can be self-registered on most WooCommerce membership sites without administrator approval. No CISA KEV listing or public proof-of-concept code has been identified at time of analysis, which tempers urgency somewhat, but the accessible attack surface means even a small-to-mid-sized WooCommerce operator (analogous to a municipal e-commerce deployment in a town like sanok) should treat remediation as a near-term priority rather than a deferred maintenance item. The availability impact (A:L) is minor and likely reflects potential for resource-intensive query injection rather than denial of service. EPSS data was not provided; given the low-privilege, network-accessible nature of the flaw, real-world exploitation probability should be considered meaningful if the vulnerability becomes publicly disclosed with a working payload.

An attacker self-registers for a subscriber account on a WooCommerce membership site running the vulnerable plugin, then crafts an HTTP request to a plugin endpoint that passes unsanitized input into a SQL query. By injecting UNION-based or time-based blind SQL payloads, the attacker can enumerate and extract the contents of the WordPress database, including user credentials (hashed passwords), email addresses, order history, and any data stored by other plugins. No public proof-of-concept code has been identified at time of analysis, but the technique is well-understood and requires only standard SQLi tooling.