CVE-2026-59537

This SQL injection in a WooCommerce extension carries a CVSS 7.6 precisely because 'administrator-only' is not a security boundary — it's an access control check. In multisite and hosted WooCommerce environments, admin accounts are customer accounts: compromised via phishing, credential stuffing, or shared-hosting privilege escalation. The developers likely assumed 'only admins reach this function' was sufficient security reasoning. It wasn't. The unescaped SQL lives in whatever admin utility, AJAX handler, or bulk-action processor handles the vulnerable input — these are the forgotten sediment layers of plugin development, the boring code that gets marked 'stable' and never reviewed again. The vulnerability class persists because $wpdb->prepare() has existed since WordPress 2.0, yet the plugin used $wpdb->query() with string interpolation. That's not a knowledge gap — it's a workflow gap: either a developer wrote unsafe SQL during a feature sprint with no reviewer catch, or inherited code from an acquisition that never underwent security re-audit. Check your composer.json or plugin headers to trace whether this code arrived via acquisition. Your immediate actions: (1) confirm the plugin version and whether your environment auto-updates; (2) grep the plugin codebase for $wpdb->query( with string concatenation — that's your indicator of systemic risk beyond this single CVE; (3) if the plugin was acquired, flag it for full query-layer refactoring, not just this patch — inherited SQL injection debt tends to be compound. The CVSS 7.6 accounts for the blast radius: a compromised admin in WooCommerce is a direct pivot to customer PII, order history, and payment tokens across every merchant on that installation.

Reviewed through automated stages and approved by a human before publication.