CVE-2026-87770

Name of the Vulnerable Software and Affected Versions Price Drop Alert for Woo Commerce WordPress plugin versions prior to 1.2

Description An issue exists where the plugin fails to sanitize and escape parameters used in a SQL query within an AJAX action accessible to unauthenticated users. This allows unauthenticated attackers to execute SQL injection attacks, which is a technique used to manipulate database queries, to extract sensitive information from the database via the product parameter.

Recommendations Update the plugin to a version newer than 1.1. Avoid using the product parameter in the affected AJAX action until the update is applied.