What is the CVSS score of CVE-2026-54849?

CVE-2026-54849 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Premmerce Wishlist are affected by CVE-2026-54849?

The Premmerce Wishlist for WooCommerce plugin (versions 1.1.11 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract customer records and password…

How to fix or mitigate CVE-2026-54849?

24 hours: Deactivate and remove the Premmerce Wishlist plugin (all versions through 1.1.11) from all WordPress/WooCommerce installations. Review database access logs for signs of unauthorized SQL queries. 7 days: Complete forensic analysis of database logs from plugin installation date forward; notify customers if unauthorized access is confirmed; identify replacement wishlist solution or custom alternative. 30 days: Monitor Patchstack advisory and WordPress plugin repository for vendor-released patches; apply immediately upon release; if plugin was exposed on public-facing sites, execute precautionary password reset for all customer accounts.

Premmerce Wishlist CVE-2026-54849

EUVD-2026-39373 CRITICAL

SQL Injection (CWE-89)

2026-06-25 Patchstack

GHSA-vqcv-7pvp-5rhv

WordPress SQLi Wordpress Plugin Premmerce Wishlist For Woocommerce Premmerce

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) yields full DB read (C:H) and plausible limited writes (I:L); kept S:U as injection stays within the database trust boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:20 vuln.today

CVE Published

Jun 25, 2026 - 13:12 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Articles & Coverage 2

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026 News Critical SQL Injection in WordPress Premmerce Wishlist for WooCommerce - CVE-2026-54849 Jun 25, 2026

AnalysisAI

SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.

Technical ContextAI

The affected component is Premmerce Wishlist for WooCommerce, an e-commerce wishlist plugin running on the WordPress/WooCommerce stack (PHP backed by a MySQL/MariaDB database), identified by CPE cpe:2.3:a:premmerce:premmerce_wishlist_for_woocommerce. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a SQL query without proper parameterization or escaping - typically a wishlist parameter (e.g. product/wishlist ID) passed through an AJAX or query-string handler that bypasses WordPress's $wpdb->prepare() safeguards. Because WordPress AJAX endpoints (wp-admin/admin-ajax.php) and nopriv hooks can be reachable without login, an unauthenticated path to the vulnerable query is consistent with the PR:N rating.

RemediationAI

No vendor-released patched version is named in the available data; the advisory states only that versions up to and including 1.1.11 are affected, so the primary action is to upgrade to the next release above 1.1.11 once published by Premmerce (verify the fixed version directly via the Patchstack advisory and the plugin's WordPress.org changelog before relying on it). Until a confirmed fixed version is installed, deactivate and remove the Premmerce Wishlist for WooCommerce plugin if the wishlist feature is non-essential - this fully removes the attack surface at the cost of losing wishlist functionality. As a lower-impact compensating control, place a WAF rule (e.g. Patchstack, Wordfence, or ModSecurity) in front of the site to block SQL-injection patterns against the plugin's AJAX/query endpoints, accepting that signature-based filtering may be bypassable and can cause false positives. Restricting or rate-limiting access to wp-admin/admin-ajax.php and monitoring database query logs for anomalies are additional defensive measures. Reference: the Patchstack advisory URL above.