Unauthenticated SQL injection in Lumise Product Designer for WooCommerce (CVE-2026-9713)

The Lumise Product Designer for WooCommerce WordPress plugin is vulnerable to SQL injection via the 'id' and 'table' parameters in the cart JSON file processed by the checkout AJAX action. The 'id' field is interpolated without quotes into a WHERE clause and 'table' into a FROM clause inside the find_resource() function, with neither parameter passed through $wpdb->prepare() or otherwise sanitized. Unauthenticated attackers can exploit this to extract sensitive information from the database. Affected versions: - <= 2.1.1 We recommend updating to: 2.1.2. CVSS 7.5 · our assessment: this_week Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7555a1-18dc-4b00-81f6-b26706cfb573?source=cve Details: https://vuln.today/cve/CVE-2026-9713