CVE-2026-18884: WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can attempt exploitation over the network. No account, privileges, or user interaction are required.
Which installations are affected?
WooCommerce Lottery versions up to and including 2.2.9 are affected. The issue is in handling of the GET parameters named "orderby" and "order".
What could an attacker gain from successful exploitation?
An attacker can append SQL to existing queries and use time-based techniques to extract sensitive information from the WordPress database. The provided impact information indicates confidentiality impact, with no stated integrity or availability impact.
How can I determine whether exploitation attempts are occurring?
Review web-server, application, and security logs for requests targeting the affected plugin functionality that include unusual or SQL-like values in the "orderby" or "order" GET parameters. Time-based SQL injection attempts may also produce requests with unusually long response times.