What is the CVSS score of CVE-2026-12936?

CVE-2026-12936 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Recurio WooCommerce CVE-2026-12936

EUVD-2026-42216 MEDIUM

SQL Injection (CWE-89)

2026-07-08 Wordfence

GHSA-32p7-vhx7-9q3f

WordPress SQLi Wordpress Plugin Recurio Ultimate Subscription For Woocommerce Devitemsllc

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

PR:H confirmed by description (shop manager required); C:H reflects full DB read access; I:N/A:N as no write or disruption impact is described.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:47 vuln.today

CVE Published

Jul 08, 2026 - 11:30 nvd

MEDIUM 4.9

DescriptionCVE.org

The Recurio - Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the Recurio - Ultimate Subscription for WooCommerce WordPress plugin (versions up to and including 1.1.3) exposes the full WordPress database to authenticated shop managers via an unsanitized 'data' parameter in the subscription engine. Attackers with shop manager-level credentials or higher can append arbitrary SQL clauses to existing queries, enabling extraction of sensitive records including customer PII, order history, and WordPress user data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially limits the real-world attack surface.

Technical ContextAI

The vulnerability resides in the DevItems LLC plugin's core subscription engine class at includes/core/class-subscription-engine.php, specifically at lines 301 and 1095 (confirmed via WordPress plugin SVN references at tags/1.1.2). The 'data' parameter is concatenated into raw SQL queries without adequate escaping or use of WordPress's prepared statement API (wpdb::prepare), yielding a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. The CPE string cpe:2.3:a:devitemsllc:recurio_-_ultimate_subscription_for_woocommerce confirms the affected vendor (DevItems LLC) and product. Because the plugin integrates with WooCommerce's commerce layer, the underlying database likely contains order, subscription, and payment-method metadata in addition to standard WordPress user tables.

RemediationAI

A code fix has been committed to the WordPress plugin SVN repository as changeset 3593971 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3593971%40recurio&new=3593971%40recurio); however, the exact patched release version number is not independently confirmed by the available reference data - administrators should update the plugin to the latest available version through the WordPress dashboard and verify the installed version exceeds 1.1.3. As an immediate compensating control, audit all accounts holding the WooCommerce shop manager role or higher and revoke any assignments to untrusted or unnecessary users, since privilege escalation to shop manager is the prerequisite for exploitation. Enabling a web application firewall rule targeting SQL metacharacter injection in POST parameters (e.g., via Wordfence Premium or a similar WAF) can provide detection and blocking while a confirmed patched release is validated. Monitor the Wordfence advisory page for patched version confirmation before closing this finding.