EUVD-2026-89880
GHSA-5qhc-j438-p2cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress admin session
-
ExploitSubmit crafted input to plugin admin feature
-
ExecutionInjected SQL executes against database
-
ImpactExfiltrate sensitive WordPress data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress Administrator account on a site running the Category Discount Woocommerce (woo-product-category-discount) plugin version 5.18 or earlier, alongside WooCommerce. The PR:H requirement is the primary limiting factor: only the highest-privilege role can reach the vulnerable code, so exploitation is realistic mainly as a post-account-compromise or insider action rather than opportunistic remote attack. No user interaction is required beyond the attacker's own authenticated request (UI:N), and no non-default configuration is noted other than having the plugin installed and active. |
| Impact | This is a high-CVSS-number but relatively low-real-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6) confirms network reach and low complexity, but the decisive limiter is PR:H - exploitation requires Administrator privileges. On WordPress, an administrator already possesses legitimate, broad database access through the admin dashboard and can install arbitrary code, so a SQL injection reachable only by an admin adds little practical adversary capability beyond what that role already grants; its main value is as a post-compromise or defense-evasion primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, which aligns with 'no public exploit identified at time of analysis.' The S:C (scope change) and C:H rating suggest data outside the plugin's own security scope (the broader WordPress DB) can be read. No SSVC decision data was provided. Signals are internally consistent - there is no conflict between the network vector and the description - but the privilege requirement makes this a lower-urgency patch than the raw 7.6 implies. |
| Exploit ScenarioDerived | An authenticated WordPress Administrator (or an attacker who has already hijacked such an account via phishing or credential theft) submits a crafted parameter to the Category Discount Woocommerce plugin's admin functionality, injecting SQL that the plugin passes unsanitized to the database. The injected query reads sensitive data from the wider WordPress database (e.g., user records, secrets in wp_options). No public exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
RemediationAI
Patch status is not confirmed from the available data: no exact fix version is given in the input, and the sole reference is the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-product-category-discount/vulnerability/wordpress-category-discount-woocommerce-plugin-5-18-sql-injection-vulnerability?_s_id=cve, which should be checked for a patched release before assuming one exists; do not infer a fixed version number from the '<= 5.18' phrasing. If a plugin update addressing the injection is published, upgrading is the primary fix - validate it on a staging copy first because WooCommerce discount plugins frequently change pricing/cart behavior. Where no fix is yet available, the highest-value compensating control is reducing who can reach the vulnerable administrative code path: audit and minimize Administrator accounts, remove the plugin entirely if no category-discount functionality is actively used (the cleanest elimination of exposure, at the cost of losing the feature), and enforce least privilege so editors/shop managers cannot be escalated into admin. Additional measures: apply a WAF or reverse-proxy rule set that inspects requests to wp-admin for SQL metacharacters in plugin-specific parameters (trade-off: potential false positives on legitimate admin form submissions and evasion via encoding), restrict wp-admin access by IP allowlist or VPN with HTTP authentication (trade-off: breaks remote/roaming administrators), and rotate WordPress database credentials plus salts if compromise is suspected since the same SQL path could read wp_users hashes and wp_options secrets. Monitor for anomalous administrator logins and unusual plugin-endpoint query patterns, as the PR:H requirement means the most reliable detection signal is an unexpected or newly created admin session.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), i.e., SQL injection. The affected component is a third-party WordPress plugin, Category Discount WooCommerce, tracked by CPE cpe:2.3:a:vidish:category_discount_woocommerce:*:*:*:*:*:*:*:* - the vendor namespace 'vidish' and product string correspond to the plugin directory woo-product-category-discount. The plugin extends WooCommerce with category-based discount logic and exposes administrative screens; the vulnerable code path takes administrator-supplied input and incorporates it into a database query without adequate parameterization or escaping, a classic failure mode in older WordPress plugin code that relies on string concatenation into $wpdb queries. Because the CVSS vector carries PR:H, the injectable parameter is behind a capability check that only Administrator-level users satisfy. The vector also carries S:C (scope changed), reflecting that successful injection reaches the shared WordPress database and can expose data beyond the plugin's own tables - core wp_users password hashes, wp_options, and WooCommerce order/customer tables are all in scope. Impact is asymmetric: C:H with I:N and A:L means the primary damage is disclosure of sensitive database contents and a modest availability effect, rather than data tampering. Exploitation requires no user interaction (UI:N) and no non-default configuration beyond having the plugin installed and active alongside WooCommerce.
Know when Category Discount Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Network-reachable admin-only SQLi, so AV:N/AC:L/PR:H; injection can read data beyond the plugin's scope (S:C, C:H) with limited availability impact and no confirmed integrity effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Executive ViewAI
The Category Discount WooCommerce WordPress plugin (versions up to and including 5.18) contains a high-severity SQL injection vulnerability that requires an authenticated administrator to exploit, potentially leading to unauthorized access to sensitive database information. With no vendor patch available, the primary risk stems from malicious insiders or compromised admin accounts, making robust administrative access controls critical. Leadership should direct immediate efforts to identify affected sites and limit administrative privileges to reduce the likelihood of a data breach.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting WordPress administrator access to trusted personnel, enforcing multi-factor authentication, implementing WAF rules to block SQL injection attempts against admin-side functionality, and monitoring administrative activity for signs of exploitation. If the plugin is not essential, disable and remove it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB