What is the CVSS score of CVE-2026-39441?

CVE-2026-39441 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Feed KuantoKusta for WooCommerce are affected by CVE-2026-39441?

WordPress sites using Feed KuantoKusta for WooCommerce (versions ≤5.3) face critical risk from an unauthenticated SQL injection vulnerability (CVE-2026-39441, CVSS 9.3) with no vendor patch…

How to fix or mitigate CVE-2026-39441?

Within 24 hours: Audit all WordPress environments for Feed KuantoKusta through version 5.3; disable the plugin immediately on all affected systems, or if business-critical, fully isolate affected servers from external network access. Within 7 days: Deploy Web Application Firewall (WAF) rules configured to detect and block SQL injection attack patterns; implement database activity monitoring with real-time alerting for suspicious query execution. Within 30 days: Monitor Patchstack advisory EUVD-2026-36926 for patch availability; evaluate and migrate to alternative WooCommerce feed management solutions to eliminate exposure.

Feed KuantoKusta for WooCommerce CVE-2026-39441

EUVD-2026-36926 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-wxhf-xjhx-2vh3

WordPress SQLi Feed Kuantokusta For Woocommerce Free

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Network-reachable WordPress plugin endpoint, no auth or interaction (PR:N/UI:N); scope changed because SQLi reads beyond plugin context into core/WooCommerce tables; SELECT-only injection yields C:H, I:N, low A:L from heavy queries.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:34 vuln.today

CVE Published

Jun 15, 2026 - 20:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce - Free <= 5.3 versions.

Articles & Coverage 1

News Critical SQL Injection in WordPress Feed KuantoKusta for WooCommerce - CVE-2026-39441 Jun 16, 2026

AnalysisAI

Unauthenticated SQL injection in the Feed KuantoKusta for WooCommerce Free WordPress plugin (versions n/a through 5.3) allows remote attackers to inject crafted SQL statements without prior authentication. Disclosed via Patchstack and tracked as EUVD-2026-36926, the flaw carries a CVSS 3.1 score of 9.3 with a changed scope, indicating data exposure beyond the plugin's own context. No public exploit identified at time of analysis, and no EPSS or KEV signal was provided in the input.

Technical ContextAI

The affected component is a WordPress plugin by Naked Cat Plugins (Webdados) that generates product feeds for the KuantoKusta price-comparison marketplace, integrating with WooCommerce. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into a database query without proper parameterization or escaping via wpdb->prepare(). Because WordPress plugins typically execute SQL through the shared $wpdb handle against the site's MySQL/MariaDB database, an injection point in a publicly reachable plugin endpoint exposes the entire WordPress schema - including wp_users, wp_usermeta, and WooCommerce order tables.

RemediationAI

No vendor-released patched version is independently confirmed in the supplied data - the input only specifies vulnerable range '≤5.3' without naming a fixed release - so administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/feed-kuantokusta-for-woocommerce/vulnerability/wordpress-feed-kuantokusta-for-woocommerce-free-plugin-5-3-sql-injection-vulnerability for the latest fixed version and upgrade to any release above 5.3 if published. Until upgrade is verified, deactivate and remove the Feed KuantoKusta for WooCommerce - Free plugin (trade-off: KuantoKusta product feed generation stops, breaking that marketplace integration), or place the site behind a WAF with virtual-patching rules for this CVE (Patchstack and Wordfence typically ship such signatures). As an interim network control, restrict access to the plugin's feed endpoints via web-server ACLs or HTTP basic auth (trade-off: legitimate KuantoKusta crawlers may be blocked, requiring IP allowlisting).