Which versions of SureCart are affected by CVE-2026-9065?

SureCart WordPress plugin versions before 4.2.1 contain a critical SQL injection vulnerability allowing authenticated administrators to extract the complete database, including customer payment…. A patch is available.

How to fix or mitigate CVE-2026-9065?

Within 24 hours: Identify all SureCart installations and verify current versions; audit REST API access logs for suspicious queries to the /surecart/v1/integrations/{id} endpoint. Within 7 days: Update all SureCart plugin installations to version 4.2.1 or later. Within 30 days: Review administrative account activity logs during the vulnerability window and reset credentials for high-privileged users.

SureCart CVE-2026-9065

Q: What is the CVSS score of CVE-2026-9065?

CVE-2026-9065 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31072 CRITICAL

SQL Injection (CWE-89)

2026-05-20 tenable

GHSA-qp65-j7f9-qv73

WordPress SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 09:30 vuln.today

Patch available

May 20, 2026 - 09:01 EUVD

DescriptionCVE.org

SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'.

The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do not contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.

AnalysisAI

SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).

Technical ContextAI

SureCart is a WordPress e-commerce plugin developed by Brainstorm Force (CPE: cpe:2.3:a:brainstormforce:surecart). The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) rooted in a logic flaw within the plugin's internal wp-query-builder abstraction. The where() method conditionally applies WordPress's standard $wpdb->prepare() sanitization, but skips it whenever the input value contains either a period ('.') or the 'wp_' table prefix string - apparently to allow column-qualified references like 'table.column'. Injecting a dot in user-controlled parameters (model_name, model_id, integration_id, provider) on the REST integration endpoint causes the raw value to be concatenated into the WHERE clause, enabling UNION-based extraction of arbitrary database tables including users, options, and session data.

RemediationAI

Vendor-released patch: upgrade SureCart to version 4.2.1 or later, which corrects the wp-query-builder where() sanitization logic so that the dot/'wp_' bypass no longer skips $wpdb->prepare(). Administrators should consult the Tenable advisory at https://www.tenable.com/security/research/tra-2026-43 for technical context and verify the plugin version across all WordPress sites. As an interim compensating control until the patch is deployed, restrict access to the /wp-json/surecart/v1/integrations/* REST routes via a web application firewall or .htaccess rule limited to known administrative IP addresses (trade-off: legitimate API integrations and remote admin workflows may break), and audit the WordPress user roster to revoke high-privilege accounts that do not strictly require SureCart management capabilities, reducing the pool of accounts able to satisfy the PR:H requirement.