CVE-2026-18884: WooCommerce Lottery Plugin SQL Injection

CVE-2026-18884 Overview

CVE-2026-18884 is a time-based SQL injection vulnerability in the WooCommerce Lottery plugin for WordPress. The flaw affects all versions up to and including 2.2.9. Unauthenticated attackers can inject SQL payloads through the orderby and order GET parameters. The vulnerability stems from insufficient escaping of user-supplied input and missing query preparation in the plugin's entry list logic. Successful exploitation allows attackers to extract sensitive data from the WordPress database, including user credentials, session tokens, and personally identifiable information stored in wp_users and related tables.

Critical Impact
Unauthenticated attackers can extract confidential database contents from any WordPress site running WooCommerce Lottery version 2.2.9 or earlier by manipulating orderby and order GET parameters.

Affected Products

WooCommerce Lottery plugin for WordPress (all versions through 2.2.9)
WordPress installations with the plugin activated
WooCommerce environments integrating the Lottery extension

Discovery Timeline

2026-08-26 - CVE-2026-18884 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18884

Vulnerability Analysis

The vulnerability resides in the class-wc-lottery-entry-list-tables.php file within the plugin's public directory. The affected code paths handle sorting logic for lottery entry listings. User-controlled orderby and order GET parameters flow directly into SQL statements without proper sanitization or use of $wpdb->prepare(). This falls under [CWE-89] Improper Neutralization of Special Elements Used in an SQL Command.

Because the injection appears in the ORDER BY clause, standard escaping functions do not neutralize the payload. Attackers rely on time-based blind techniques, using MySQL functions such as SLEEP() or BENCHMARK() inside conditional expressions. Response latency reveals whether each guessed character of extracted data is correct.

The attacker requires no authentication, no user interaction, and only network access to a vulnerable endpoint. Impact is limited to confidentiality because the injection channel favors data exfiltration over modification.

Root Cause

The plugin concatenates the orderby and order GET parameters directly into raw SQL queries executed against the WordPress database. The ORDER BY clause cannot be parameterized through prepared statements, and the plugin does not apply an allowlist of valid column names or sort directions. This design flaw makes any input reaching the query executable as SQL syntax.

Attack Vector

An attacker sends a crafted HTTP GET request to a page rendering the lottery entry list. The malicious orderby value contains conditional SQL that triggers a measurable delay when a target condition is true. By iterating over character positions and comparing response times, the attacker reconstructs database contents byte by byte. Automated tools such as sqlmap can operationalize the extraction against the vulnerable endpoint.

No verified public exploit code has been released. The vulnerability mechanism is documented in the Wordfence Vulnerability Analysis and the affected source lines are visible in the WordPress plugin repository.

Detection Methods for CVE-2026-18884

Indicators of Compromise

HTTP GET requests containing SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or IF( in the orderby or order parameters.
Unusually long response times on pages that render WooCommerce Lottery entry lists.
Repeated requests from a single source with incremental changes to the orderby value, indicative of blind extraction.
Web server access logs showing URL-encoded parentheses, commas, or comment sequences (--, #) in query strings targeting lottery endpoints.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect GET parameters for SQL injection signatures, particularly on WordPress endpoints.
Enable MySQL slow query logging to identify time-based payloads exceeding normal execution thresholds.
Correlate WordPress access logs with database query logs to detect anomalous ordering clauses.
Baseline expected values for orderby (typically column names) and alert on deviations.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and MySQL logs to a centralized analytics platform for correlation.
Monitor for successive requests with response times clustering near multiples of the attacker-selected SLEEP delay.
Track authentication anomalies following suspected extraction attempts, as leaked password hashes may fuel later credential attacks.

How to Mitigate CVE-2026-18884

Immediate Actions Required

Update the WooCommerce Lottery plugin to a version newer than 2.2.9 once the vendor publishes a fix; consult the CodeCanyon changelog for release status.
Disable or uninstall the plugin on production sites if no patched version is available.
Rotate WordPress administrator passwords and secret keys defined in wp-config.php if exploitation is suspected.
Audit the wp_users table for unauthorized accounts or modified privileges.

Patch Information

At the time of publication, no confirmed patched release is referenced in the NVD entry. Site owners should monitor the CodeCanyon product page and the Wordfence advisory for remediation guidance.

Workarounds

Restrict access to lottery entry list pages using .htaccess or reverse proxy allowlists until a patch is applied.
Deploy a WAF rule blocking requests where orderby or order parameters contain non-alphanumeric characters.
Enforce least-privilege database credentials for the WordPress user, removing FILE and cross-database access rights.
Enable rate limiting on lottery endpoints to slow automated blind extraction attempts.

bash

# Example ModSecurity rule to block suspicious orderby payloads
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|select|union|if\()" \
    "id:1018884,phase:2,deny,status:403,\
    msg:'CVE-2026-18884 WooCommerce Lottery SQLi attempt'"
SecRule ARGS:order "!@rx ^(asc|desc)$" \
    "id:1018885,phase:2,deny,status:403,\
    msg:'CVE-2026-18884 Invalid order parameter'"