CVE-2026-2232

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-223206.5A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to tr CVE-2026-223215.3A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexp CVE-2026-223227.1A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker CVE-2026-223237.1A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users CVE-2026-223248.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania al CVE-2026-223258.1Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.CVE-2026-223268.1Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.CVE-2026-223279.9Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.CVE-2026-223287.1Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.CVE-2026-223297.1Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.CVE-2026-22335.3The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable t CVE-2026-223308.1Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.