CVE-2026-32459

| EUVD-2026-12017 HIGH
2026-03-13 Patchstack
8.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

3
Analysis Generated
Mar 13, 2026 - 16:57 vuln.today
EUVD ID Assigned
Mar 13, 2026 - 16:57 euvd
EUVD-2026-12017
CVE Published
Mar 13, 2026 - 11:42 nvd
HIGH 8.5

Tags

SQLi Upsellwp

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

Analysis

Blind SQL injection in UpsellWP checkout plugin versions 2.2.4 and earlier allows authenticated attackers to execute arbitrary SQL queries with network access and without user interaction. The vulnerability affects the checkout-upsell-and-order-bumps functionality and could enable data exfiltration or database manipulation. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Inventory all WordPress instances running UpsellWP and confirm installed versions; disable the UpsellWP plugin if version ≤2.2.4 is detected. Within 7 days: Evaluate alternative checkout upsell solutions; conduct database access logs review for suspicious SQL queries; implement Web Application Firewall rules to block SQL injection patterns. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

43
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +42
POC: 0

Share

CVE-2026-32459 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy