What is the CVSS score of CVE-2026-57765?

CVE-2026-57765 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP EasyCart are affected by CVE-2026-57765?

WP EasyCart WordPress e-commerce plugin (versions through 5.9.0) contains a SQL injection vulnerability allowing Contributor-level users to access customer orders, payment records, and credential…

How to fix or mitigate CVE-2026-57765?

Within 24 hours: Audit all WordPress installations for WP EasyCart ≤v5.9.0; immediately revoke or restrict Contributor role permissions to only trusted administrators. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting EasyCart backend queries; enable database query auditing and configure real-time alerts for anomalous activity. Within 30 days: Monitor vendor and Patchstack advisories for security updates; if no patch emerges, evaluate plugin replacement or implement comprehensive database access controls with credential rotation.

WP EasyCart CVE-2026-57765

EUVD-2026-41320 HIGH

SQL Injection (CWE-89)

2026-07-02 Patchstack

GHSA-5rmv-7mhc-rw9q

WordPress SQLi Wp Easycart Wordpress Plugin Levelfourdevelopment

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable low-complexity SQLi needs a Contributor account (PR:L); DB read across shared WordPress tables justifies S:C and C:H, with no integrity and only low availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:20 vuln.today

DescriptionCVE.org

Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.

AnalysisAI

SQL injection in the WP EasyCart WordPress e-commerce plugin (all versions up to and including 5.9.0) lets a low-privileged authenticated user with Contributor role inject arbitrary SQL into backend queries. Reported by Patchstack and rated CVSS 8.5, the flaw allows attackers to read sensitive database contents such as customer records, order data, and WordPress user credential hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is WP EasyCart (vendor levelfourdevelopment, CPE cpe:2.3:a:levelfourdevelopment:wp_easycart), a shopping-cart/e-commerce plugin for WordPress that stores products, customers, and orders in the WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input reachable by a Contributor is concatenated into a SQL statement without proper parameterization or escaping, so crafted input alters query structure. Because WordPress plugins share the site's single database connection and credentials, a successful injection is not confined to the plugin's own tables and can reach core WordPress tables (e.g. wp_users, wp_usermeta).

RemediationAI

Upgrade WP EasyCart to a release later than 5.9.0 once confirmed via the vendor/Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-easycart/vulnerability/wordpress-wp-easycart-plugin-5-9-0-sql-injection-vulnerability); no vendor-released patch version was identified in the provided data, so verify the fixed version on that advisory before deploying. Until a patched version is applied, reduce exposure by restricting who holds Contributor-or-higher roles and auditing existing low-privilege accounts, since exploitation requires an authenticated Contributor - disable open user registration or lower the default new-user role to Subscriber (trade-off: legitimate contributors lose self-service access). As a compensating control, deploy a WordPress WAF/virtual patch (e.g. Patchstack) with SQLi rules targeting the plugin's endpoints, and apply least-privilege database credentials for WordPress where feasible (trade-off: some plugins expect broad DB rights and may break). Monitor database and web logs for anomalous queries against wp_users/order tables.