eShipper Commerce CVE-2026-74013

Requires a valid WordPress subscriber-level account on the target site, as confirmed by the PR:L metric in the CVSS vector. The subscriber role is the default role assigned to any registered WordPress user, so any site that permits open user registration is exploitable by self-registered attackers without any prior relationship to the site. Sites that have disabled new user registration and restrict account creation to administrators materially reduce exposure, forcing attackers to first compromise an existing account through other means. No specific non-default plugin feature, configuration setting, or deployment mode is cited as a prerequisite - the vulnerability appears to reside in core plugin functionality accessible to all authenticated subscribers. Limiting factors: attacker must be authenticated at subscriber level or above; exploitation is bounded to the database server accessible to the WordPress installation.

The CVSS 8.5 High score reflects a genuinely significant attack surface: network-reachable, low-complexity SQL injection with scope change and high confidentiality impact. The primary real-world risk limiter is PR:L - attackers must hold a WordPress subscriber account on the target site, which meaningfully reduces opportunistic mass exploitation relative to a PR:N vector. Sites permitting open user registration are effectively exposed to unauthenticated registration followed by immediate exploitation, while sites with registration disabled require a compromised or insider account. No EPSS probability score was provided in the input data, preventing quantitative likelihood calibration. The absence of a KEV listing and no reported POC suggests exploitation has not yet been broadly commoditized, but the low attack complexity (AC:L) means the barrier to independent development is low. The I:N integrity metric in the provided vector warrants scrutiny - SQL injection vulnerabilities typically afford at minimum limited write capability; if the vulnerable endpoint is strictly read-only (e.g., SELECT-only context), I:N is defensible, but this should be verified against the plugin source or vendor advisory.

An attacker registers a free subscriber account on a target WordPress site running eShipper Commerce 2.16.13 or earlier - possible on any site with open user registration enabled - then sends a crafted HTTP request to the vulnerable plugin endpoint embedding SQL injection payloads. The malicious query traverses the database scope boundary, extracting contents of the wp_users table including hashed passwords and email addresses, which the attacker subsequently uses for credential cracking or account takeover. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means the technique is reproducible by any moderately skilled attacker familiar with WordPress plugin SQL injection patterns.