What is the CVSS score of CVE-2026-42773?

CVE-2026-42773 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of eMagicOne Store Manager are affected by CVE-2026-42773?

eMagicOne Store Manager WordPress plugin versions 1.3.2 and earlier contain a critical blind SQL injection vulnerability allowing unauthenticated remote attackers to extract database contents without…

How to fix or mitigate CVE-2026-42773?

Within 24 hours: Scan all WordPress installations to identify deployments of eMagicOne Store Manager 1.3.2 or earlier; immediately deactivate and remove the affected plugin; deploy Web Application Firewall rules to block SQL injection patterns. Within 7 days: Conduct forensic database analysis for unauthorized access attempts and SQL injection signatures; review database logs and access patterns for anomalous activity; engage database team for full integrity assessment. Within 30 days: Identify and deploy alternative WordPress store management solutions; complete incident documentation and update vendor risk management procedures.

eMagicOne Store Manager CVE-2026-42773

EUVD-2026-31749 CRITICAL

SQL Injection (CWE-89)

2026-05-25 Patchstack

GHSA-5ffv-prf8-5rc6

WordPress SQLi Wordpress Plugin Emagicone Store Manager Emagicone

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:30 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection.

This issue affects eMagicOne Store Manager: from n/a through 1.3.2.

AnalysisAI

Blind SQL injection in the eMagicOne Store Manager WordPress plugin (versions up to and including 1.3.2) allows remote unauthenticated attackers to inject malicious SQL through improperly sanitized parameters. With a CVSS 9.3 score and changed scope, successful exploitation can expose confidential database contents across the WordPress installation, though EPSS remains very low (0.03%) and no public exploit identified at time of analysis.

Technical ContextAI

The flaw is a CWE-89 SQL Injection affecting the eMagicOne Store Manager plugin for WordPress (CPE cpe:2.3:a:emagicone:emagicone_store_manager), a connector that bridges remote Store Manager desktop software with WooCommerce/WordPress stores. User-supplied input is concatenated into SQL queries without adequate neutralization of special characters, allowing attackers to alter query logic. Because responses do not return data directly, exploitation relies on blind techniques (boolean-based or time-based inference) where the attacker deduces information through behavioral differences in server responses.

RemediationAI

No vendor-released patch identified at time of analysis - the supplied references list the affected range as 'n/a through 1.3.2' without a fixed version, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/store-manager-connector/vulnerability/wordpress-emagicone-store-manager-plugin-1-3-2-sql-injection-vulnerability) and the eMagicOne vendor site for an updated build above 1.3.2 and apply it immediately when released. Until then, deactivate the Store Manager Connector plugin on production WordPress installations where the desktop sync feature is not essential, or restrict access to the plugin's REST/AJAX endpoints with a WAF rule blocking SQL meta-characters and tautology patterns (side effect: legitimate Store Manager desktop clients may lose connectivity); additionally enforce least-privilege on the WordPress database user to limit the blast radius of any successful injection, accepting that this does not prevent confidentiality loss within accessible tables.