A critical SQL injection vulnerability in the Price Drop Alert for Woo Commerce plugin allows unauthenticated attackers to exfiltrate sensitive data from the WordPress database.

This flaw is a SQL injection vulnerability (CWE-89) triggered by the failure to sanitize user-supplied parameters within an AJAX action. The vulnerability is accessible to unauthenticated attackers, who can leverage the endpoint to execute arbitrary SQL commands.

The ability for an unauthenticated attacker to inject SQL commands into the database poses a severe risk to data confidentiality. Successful exploitation could lead to the unauthorized disclosure of sensitive customer information, administrative credentials, or proprietary site data, potentially resulting in significant reputational damage and regulatory noncompliance. Given the CVSS score of 8.6, this vulnerability is classified as high severity and requires immediate attention to prevent unauthorized data access.

Immediate Action: Since no official patch is currently available, administrators should immediately deactivate and remove the Price Drop Alert for Woo Commerce plugin from all affected WordPress installations.

Proactive Monitoring: Security teams should monitor database logs for suspicious query patterns, particularly those originating from AJAX-related endpoints or containing unexpected SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting AJAX parameters until the plugin can be removed or a secure version is released.

Public Exploit Available: No

Given the high CVSS score and the ability for unauthenticated attackers to manipulate the backend database, this vulnerability represents an urgent security risk. Organizations currently utilizing the Price Drop Alert for Woo Commerce plugin must treat this as a priority. Deactivation is the only reliable method to mitigate this risk until the vendor provides a patched release.