What is the CVSS score of CVE-2026-32459?

CVE-2026-32459 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Upsellwp are affected by CVE-2026-32459?

A high-severity SQL injection vulnerability in UpsellWP checkout plugin (versions ≤2.2.4) could allow attackers to extract sensitive customer and transaction data from WordPress e-commerce sites.

How to fix or mitigate CVE-2026-32459?

Within 24 hours: Inventory all WordPress instances running UpsellWP and confirm installed versions; disable the UpsellWP plugin if version ≤2.2.4 is detected. Within 7 days: Evaluate alternative checkout upsell solutions; conduct database access logs review for suspicious SQL queries; implement Web Application Firewall rules to block SQL injection patterns. Within 30 days: Migrate to patched version (when released) or approved alternative plugin; perform security assessment of affected systems; notify legal/compliance if customer data exposure is confirmed.

Upsellwp CVE-2026-32459

EUVD-2026-12017 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Upsellwp

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 10:22 NVD

8.5 (HIGH) 7.6 (HIGH)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12017

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

AnalysisAI

Blind SQL injection in UpsellWP checkout plugin versions 2.2.4 and earlier allows authenticated attackers to execute arbitrary SQL queries with network access and without user interaction. The vulnerability affects the checkout-upsell-and-order-bumps functionality and could enable data exfiltration or database manipulation. No patch is currently available for this high-severity flaw.

Technical ContextAI

The vulnerability stems from improper input validation in SQL queries within the UpsellWP plugin, specifically related to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). This WordPress e-commerce plugin handles checkout upsells and order bumps, processing user-supplied data that gets incorporated into database queries without proper sanitization. The blind SQL injection technique means attackers cannot see query results directly but can infer information through timing attacks or boolean-based responses, making data extraction slower but still feasible.

RemediationAI

Upgrade the UpsellWP plugin to version 2.2.5 or later which should contain the security fix for this SQL injection vulnerability. Website administrators should check their WordPress dashboard for available plugin updates or manually update through the Flycart website. As an interim measure, consider implementing a Web Application Firewall (WAF) with SQL injection protection rules and restricting user registration if possible to limit the pool of potential authenticated attackers. Monitor database logs for suspicious query patterns that might indicate exploitation attempts.