CVE-2026-22335: WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the WooCommerce Frontend Manager - Ultimate WordPress plugin, affecting all versions before 6.7.7. An attacker with only a subscriber-level account can reach the vulnerable endpoint over the network, with no victim interaction required, and inject malicious SQL into database queries. Successful exploitation gives the attacker read access to sensitive data stored in the WordPress database and can also partially disrupt service availability. A patched-image rebuild at version 6.7.7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress/WooCommerce service via HTTP.

• AuthenticationRequired

  A low-privilege subscriber-level account is sufficient; the attacker does not need administrative or editor privileges.

• Victim interactionNot required

  No victim action is needed; the attacker sends the malicious request directly without involving another user.

• Attack complexityDetail

  Exploit complexity is low - no race conditions, special memory layout, or environmental prerequisites are required to inject the payload reliably.

Blast Radius

• Reads confidential data stored in the WordPress database, including user records, order details, and stored session or credential material.
• Scope extends beyond the vulnerable plugin itself (CVSS scope change) meaning injected queries can reach tables owned by other WordPress components or installed plugins.
• Causes partial availability loss, for example slowing or erroring out database queries that other site functions depend on.