Premmerce Wishlist CVE-2026-54849

No special conditions beyond having the Premmerce Wishlist for WooCommerce plugin (version <= 1.1.11) installed and active on a reachable WordPress site - exploitation is remote and unauthenticated (PR:N/UI:N/AC:L) against the plugin's exposed query path. The principal limiting factor is deployment: the target must actually run this specific plugin at a vulnerable version, which constrains the realistic target population. Exploitation also depends on the vulnerable wishlist request handler being reachable (it is registered on standard WordPress AJAX/query routes), and on the database backend processing the injected SQL; there is no requirement for a non-default configuration based on the supplied description.

Signals point to a high-priority issue with caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote, unauthenticated, no-interaction exploitation, and the 9.3 score is elevated by S:C (scope change) plus C:H. However, the impact metrics are uneven: C:H (full read of database contents) but I:N and only A:L, which is unusual for SQLi - classic SQLi often permits at least limited integrity impact, so the I:N rating suggests the vendor assessed this as data-disclosure-focused. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified; no KEV listing and no POC reference means there is no evidence of active exploitation or published exploit code at this time. No SSVC decision data was provided. Net: the technical exploitability is high (unauthenticated SQLi in a web-facing plugin is highly attractive and often automatable), but real-world urgency depends on this plugin's deployment footprint, which is modest. Treat as urgent-to-patch for any site running the plugin, while recognizing the absence of in-the-wild evidence.

An attacker scanning the internet for WordPress sites running the Premmerce Wishlist plugin sends a crafted HTTP request to the vulnerable wishlist endpoint with malicious SQL embedded in a parameter, requiring no authentication or user interaction. Using UNION-based or blind SQLi techniques, they exfiltrate wp_users records including administrator email addresses and password hashes for offline cracking. No public proof-of-concept is identified at this time, but the low-complexity unauthenticated vector makes mass automated scanning a realistic threat once details circulate.