EUVD-2026-81511
GHSA-gh92-vvh9-jgw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress admin credentials
-
ExploitAccess plugin admin endpoint
-
ExecutionInject crafted SQL parameter
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user with administrator privileges (PR:H, per the CVSS vector and the 'Administrator SQL Injection' description) on a site running MC Woocommerce Wishlist ≤1.9.21. No user interaction is needed (UI:N) and it is exploitable over the network (AV:N), but the administrator-authentication prerequisite sharply limits realistic attackers to those who have already compromised or been granted an admin account. No non-default plugin configuration is indicated beyond the plugin being installed and active. |
| Impact | This is a high-CVSS-but-modest-real-risk issue. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) is elevated largely by the scope change (S:C) and network vector, but the decisive limiter is PR:H - the description explicitly labels this an 'Administrator SQL Injection', meaning the attacker must already hold WordPress administrator privileges. An administrator can already read/export the site database through legitimate admin functionality, so the marginal impact of an admin-only SQLi is low; its main value is to an attacker who has compromised an admin account or to converting limited DB access into raw/blind SQL beyond the plugin's intended queries. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced (only a Patchstack database entry), so this is best characterized as no public exploit identified at time of analysis. I question the vendor's S:C and C:H/A:L combination - a standard in-application SQLi typically stays S:U with C:H, and the A:L is weakly justified; these choices inflate the score. Net: low patch priority relative to unauthenticated SQLi, but still worth patching as defense-in-depth against admin-account compromise or lower-privileged multisite roles. |
| Exploit ScenarioDerived | An attacker who has already obtained WordPress administrator access (via phishing, credential reuse, or a separate flaw) submits a crafted parameter to a MC Woocommerce Wishlist admin endpoint that is concatenated into a SQL query, extracting arbitrary database contents such as user password hashes and secrets. No public proof-of-concept is referenced - only a Patchstack database entry - and exploitation requires the high privilege level noted in the CVSS vector (PR:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
SQL injection in the MC Woocommerce Wishlist WordPress plugin (versions up to and including 1.9.21) allows an authenticated administrator to inject arbitrary SQL through admin-facing input, potentially exposing sensitive database contents. Although rated high on CVSS, the flaw requires an existing administrator account, so realistic risk is limited to attackers who already hold admin rights; no public exploit has been identified and there is no evidence of confirmed active exploitation per CISA KEV.
RemediationAI
No vendor-released patch version is identified in the provided data; the affected range ends at MC Woocommerce Wishlist 1.9.21, but no fixed release is specified. Until a patched version is available, consider disabling or removing the plugin if wishlist functionality is not essential, which eliminates exposure but removes the feature. Restrict and audit WordPress administrator accounts so only trusted users retain admin privileges, reducing the PR:H attack surface without fixing the underlying SQL injection. Deploy a web application firewall with SQL injection rules tailored to the plugin's admin endpoints, accepting that obfuscated payloads may bypass detection and legitimate admin requests may be blocked. Monitor the Patchstack advisory for updated vendor guidance and apply any patched release beyond 1.9.21 promptly once it is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress plugin identified by CPE cpe:2.3:a:moreconvert_team:mc_woocommerce_wishlist:*:*:*:*:*:*:*:* and EUVD-2026-81511, with affected versions at or below 1.9.21. The root cause is CWE-89, improper neutralization of special elements used in an SQL command: admin-supplied input reaches a SQL query without sufficient parameterization or escaping. Because the CVSS vector contains PR:H, the injection point is reachable only after obtaining a privileged WordPress administrator session; unauthenticated visitors cannot trigger it. Under the independent assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), exploitation could result in high confidentiality impact, low integrity impact, and no availability impact.
Know when Mc Woocommerce Wishlist gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Admin-only exploitation forces PR:H; SQLi typically stays within the application DB so S:U with C:H read and limited I:L write, no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
Executive ViewAI
The MC Woocommerce Wishlist WordPress plugin, versions up to and including 1.9.21, contains a SQL injection flaw that could allow an attacker with an existing administrator account to extract sensitive database information from affected e-commerce sites. Because exploitation requires high-level administrative access and no public exploit identified at time of analysis, the immediate organizational risk is limited to environments where admin credentials are already compromised or mismanaged. Security leadership should prioritize inventory and access controls for this plugin, as no vendor-released patch identified at time of analysis is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting administrator access to trusted personnel, enforcing least privilege and multi-factor authentication for admin accounts, disabling or removing the plugin if not business-critical, deploying WAF rules to block SQL injection attempts against admin-facing inputs, monitoring database and admin activity for anomalous queries, and maintaining an inventory of affected versions for rapid response when a patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB