Security Alert Summary
The WooCommerce Lottery plugin for WordPress is affected by a time-based SQL injection vulnerability (CVE-2026-18884) that can be triggered via the orderby and order GET parameters in affected versions up to and including 2.2.9. Because the plugin does not sufficiently escape user-supplied input and fails to properly prepare the existing SQL query, unauthenticated attackers may be able to append SQL payloads to queries and extract sensitive information from the database. The issue is assigned a CVSS v3.1 base score of 7.5 (High).
CVE Details
- CVE ID: CVE-2026-18884
- Affected component: WooCommerce Lottery plugin for WordPress
- Affected versions: All versions up to and including 2.2.9
- Published: August 26, 2026 at 08:16:44 AM UTC
- Last Modified: August 26, 2026 at 04:19:05 PM UTC
- CVSS v3.1: Base score 7.5, Severity: HIGH
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact: Confidentiality: High, Integrity: None, Availability: None
- Authentication / Access: No authentication required (unauthenticated)
- Weakness: CWE-89 (SQL Injection)
Technical Details
The vulnerability is a time-based SQL injection that arises from insufficient escaping of the orderby and order GET parameters and a lack of proper preparation of the existing SQL query. An attacker can supply crafted values for those parameters which get incorporated into database queries without adequate sanitization or use of parameterized queries.
Because the injected input can modify the SQL sent to the database, an attacker can append additional SQL statements or payloads to force time-based responses and enumerate data. The CVE description indicates the weakness is due to insufficient escaping and missing preparation on the SQL query used by the plugin. The impact specified is extraction of sensitive information from the database (confidentiality loss).
How This Could Impact Your Website
On a site using the affected plugin, an unauthenticated attacker could exploit the orderby and order parameters to probe and extract data from the database. In a realistic scenario, a site owner or administrator manages the site, internal staff perform content tasks, and an external contractor or contributor may have limited access. Data exposed by this vulnerability could include stored records that contain user contact information or other sensitive fields used by staff and contractors.
Practical consequences include exposure of internal user email addresses and other data that can increase the risk of targeted phishing or social engineering against staff, contractors, or customers. The vulnerability does not, based on the provided data, indicate integrity or availability impacts, but the confidentiality risk still represents a meaningful privacy and operational concern. professional review may help determine whether your site is affected and how best to assess roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other accounts with write access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access logs for unusual behavior or probing attempts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://codecanyon.net/item/woocommerce-lottery-wordpress-prizes-and-lotteries/15075983#item-description__changelog
- https://plugins.trac.wordpress.org/browser/woocommerce-lottery/trunk/public/class-wc-lottery-entry-list-tables.php#L162
- https://plugins.trac.wordpress.org/browser/woocommerce-lottery/trunk/public/class-wc-lottery-entry-list-tables.php#L164
- https://plugins.trac.wordpress.org/browser/woocommerce-lottery/trunk/public/class-wc-lottery-entry-list-tables.php#L174
- https://plugins.trac.wordpress.org/browser/woocommerce-lottery/trunk/public/class-wc-lottery-entry-list-tables.php#L212
- https://www.wordfence.com/threat-intel/vulnerabilities/id/26a34fd5-bfa2-4675-9451-ea742bd13fa3?source=cve
