SQL Injection Vulnerability in Hyyan WooCommerce Polylang Integration Plugin for WordPress
CVE-2026-101926

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Hyyan WooCommerce Polylang Integration
Vendor
CVE Published:
14 October 2026

What is CVE-2026-101926?

The Hyyan WooCommerce Polylang Integration plugin for WordPress is susceptible to SQL Injection due to inadequate escaping of the 'variation_ids' parameter within the 'woocommerce_remove_variations' AJAX action. This flaw allows authenticated attackers, including those with Subscriber-level access and higher, to inject additional SQL queries into existing ones. Such exploitation can lead to unauthorized access and exposure of sensitive database information, seriously compromising the integrity of the affected WordPress installation.

Affected Version(s)

Hyyan WooCommerce Polylang Integration 0 <= 1.5.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woo-poly-integ...
https://plugins.trac.wordpress.org/browser/woo-poly-integ...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HYEBIN NOH (sh)
.