Cyber Resilience

CVE-2026-2579

High

Published: 17 March 2026

Published
17 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0011 28.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2579 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2579 is a SQL injection vulnerability in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress, affecting all versions up to and including 4.4.3. The flaw arises from insufficient escaping of the user-supplied 'search' parameter and lack of adequate preparation in the existing SQL query, allowing attackers to append malicious SQL queries.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation enables extraction of sensitive information from the database, such as user credentials or other confidential data, without impacting integrity or availability.

References point to specific code locations in the plugin, including lines in Functions.php (L2577) and REST_API.php (L116, L859), highlighting the vulnerable query handling, along with a Wordfence threat intelligence page detailing the issue. No patch details are specified in the available information.

EU & UK References

Vulnerability details

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and…

more

lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and direct unauthorized queries against the backend database for credential/data extraction (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2019-25537Shared CWE-89
CVE-2019-25366Shared CWE-89
CVE-2019-25496Shared CWE-89
CVE-2026-1475Shared CWE-89
CVE-2026-26990Shared CWE-89
CVE-2026-44047Shared CWE-89
CVE-2025-12865Shared CWE-89
CVE-2024-11135Shared CWE-89
CVE-2019-25491Shared CWE-89
CVE-2024-13369Shared CWE-89

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses the SQL injection vulnerability by requiring validation and sanitization of the user-supplied 'search' parameter before inclusion in database queries.

SI-2 Flaw Remediation good match
prevent

Ensures timely identification, reporting, and correction of the specific SQL injection flaw in the WowStore plugin versions up to 4.4.3 through patching.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables detection of the SQL injection vulnerability in the WowStore plugin via regular vulnerability scanning of web applications and components.

References