🔐 CVE Alert

CVE-2026-101926

MEDIUM 6.5

Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE CWE-89
Vendor hyyan
Product hyyan woocommerce polylang integration
Published Oct 14, 2026
Stay Ahead of the Next One

Get instant alerts for hyyan hyyan woocommerce polylang integration

Be the first to know when new medium vulnerabilities affecting hyyan hyyan woocommerce polylang integration are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

hyyan / Hyyan WooCommerce Polylang Integration
0 ≤ 1.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf17caa-3f05-4461-b258-ae655d95ec2e?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-poly-integration/tags/1.5.0/src/Hyyan/WPI/Product/Variation.php#L146 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-poly-integration/tags/1.5.0/src/Hyyan/WPI/Product/Variation.php#L168 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-poly-integration/tags/1.5.0/src/Hyyan/WPI/Product/Variable.php#L280 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-poly-integration/tags/1.5.0/src/Hyyan/WPI/Product/Variable.php#L35

Credits

HYEBIN NOH (sh)