EUVD-2026-68970
GHSA-45gf-cv6w-gvf5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credentials required (PR:H); read-only SQL exfiltration yields C:H with no write or availability impact; network-delivered submission (AV:N) but auth gates access.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler - which applies no sanitization to raw $_POST values - and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.
AnalysisAI
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress session with administrator-level role or higher - confirmed by CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately reflects the dual nature of this finding: the network attack vector and low complexity inflate the theoretical risk, while the PR:H requirement for WordPress administrator credentials substantially narrows the realistic attacker population to insiders, credential-compromise scenarios, or privilege-escalation chains. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WP EasyCart plugin to a version beyond 5.9.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today