CVE-2026-73346

The 'admin-only' qualifier on this SQL injection vulnerability should be treated as a classification artifact, not a security boundary. WordPress administrator credentials are routinely compromised through phishing, plugin-to-plugin pivots on shared hosting, and credential reuse—making the 'admin required' label an unreliable indicator of reduced risk. The actual attack surface extends far beyond the vulnerable endpoint: admin access gives attackers direct database credentials (often reused across an organization's services), the ability to install persistent backdoors that survive credential rotation, and pivot capability to every other site on shared hosting. WooCommerce databases contain customer PII, turning this into a data breach vector with regulatory implications that the 'admin-only' classification entirely obscures. The deeper problem is that admin-context code in WordPress plugins frequently lacks actual capability verification. Developers add AJAX handlers and REST endpoints assuming 'runs in admin' means 'trusted by default'—a pattern that was never audited as WordPress hardened. This creates forgotten paths: legacy webhook endpoints, deprecated AJAX actions, and abandoned routes that process query parameters directly into SQL strings because they predate current security expectations. For this CVE, treat the 'admin-only' label as a red flag indicating the vulnerability likely lives in an underexamined admin-context code path rather than a privileged-but-audited one. Prioritize patching immediately despite the classification, assume the database is already exposed if admin credentials were ever compromised, and audit for additional unaudited admin-context endpoints in the affected plugin before an attacker finds them first.

Reviewed through automated stages and approved by a human before publication.