What is the CVSS score of CVE-2026-32422?

CVE-2026-32422 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wp Easycart are affected by CVE-2026-32422?

A critical SQL injection vulnerability affects WP EasyCart installations through version 5.8.13, potentially allowing attackers to extract sensitive database information including customer payment…

How to fix or mitigate CVE-2026-32422?

Within 24 hours: Identify all WordPress instances running WP EasyCart and document affected versions; disable the plugin if version ≤5.8.13 confirmed. Within 7 days: Monitor vendor announcements for patch availability; implement WAF rules to block SQL injection patterns targeting the plugin; conduct database access logs review for suspicious activity. Within 30 days: Apply patch immediately upon release; perform forensic analysis to identify potential unauthorized data access; notify customers if breach is confirmed.

Wp Easycart CVE-2026-32422

EUVD-2026-11949 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Wp Easycart

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11949

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

AnalysisAI

WP EasyCart versions 5.8.13 and earlier are vulnerable to blind SQL injection, allowing authenticated attackers to execute arbitrary SQL queries through improper input sanitization. This vulnerability could enable attackers to extract or manipulate sensitive database information, though code execution is not possible. No patch is currently available for this high-severity vulnerability (CVSS 8.5).

Technical ContextAI

WP EasyCart is a WordPress e-commerce plugin developed by levelfourdevelopment that enables online store functionality. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), a classic SQL injection flaw where user-supplied input is not properly sanitized before being incorporated into SQL queries. Blind SQL injection specifically means attackers cannot see query results directly but can infer information through boolean-based or time-based techniques. The affected versions range from the initial release through version 5.8.13, indicating this is a long-standing security issue in the codebase.

RemediationAI

Upgrade WP EasyCart to a version newer than 5.8.13 immediately, as this version range is confirmed vulnerable to SQL injection attacks. If immediate patching is not possible, implement web application firewall (WAF) rules to filter SQL injection attempts, restrict plugin access to trusted administrator accounts only, and monitor database query logs for suspicious activity. Regular security audits of database queries and input validation mechanisms should be conducted, especially for any custom modifications to the plugin.