WP EasyCart CVE-2026-57765

Exploitation requires an authenticated WordPress account at the Contributor role or higher on a site running WP EasyCart version 5.9.0 or earlier (per CVSS PR:L). The attack is remote over the network (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), but the Contributor authentication prerequisite is the primary limiting factor - sites that disable open registration, or that never grant Contributor+ roles to untrusted users, are not exposed to anonymous attackers. No non-default plugin feature or special deployment mode is documented as required beyond having the vulnerable plugin installed and active.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L indicates network-reachable, low-complexity exploitation requiring low privileges (an authenticated Contributor account) and no user interaction, with a scope change and high confidentiality impact but no integrity impact and only low availability impact - consistent with a data-read SQLi rather than full RCE. No EPSS score, POC, or KEV entry was supplied, so real-world exploitation probability cannot be quantified from the provided data; the absence of KEV and POC suggests this is not currently mass-exploited. The key limiting factor is the PR:L requirement: an attacker must first obtain a Contributor (or higher) account, which meaningfully reduces exposure on sites that do not permit open/low-trust registration. Priority is moderate-to-high for multi-author WordPress stores where untrusted contributor accounts exist, and lower where authorship is tightly controlled.

An attacker registers or compromises a Contributor-level account on a WordPress site running WP EasyCart 5.9.0 or earlier, then submits crafted input to a vulnerable plugin parameter that is concatenated into a SQL query. Because the vector is network-based with low complexity and no user interaction, the attacker exfiltrates customer PII, order details, or password hashes from the shared WordPress database in a single authenticated session. No public POC was provided, so exploitation would require independent development of the injection payload.