WP EasyCart CVE-2026-94124

Requires an authenticated WordPress account at Contributor level or higher on a site running the WP EasyCart plugin version 5.9.4 or earlier (PR:L). Exploitation is remote over the network with no user interaction, but is limited by the need for valid low-privilege credentials - realistically dangerous on sites that permit open user registration or grant contributor access broadly. No non-default plugin configuration is indicated by the available data; the injectable functionality appears reachable to authenticated contributor-tier users.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection that requires only low-privilege authentication (PR:L). The 'Contributor' qualifier in the title aligns with PR:L: a self-registered or low-tier WordPress account suffices, which meaningfully lowers the bar on sites allowing open/contributor registration but still requires a valid account, unlike a fully unauthenticated flaw. No EPSS score, KEV listing, or public POC is present in the supplied data, so this is 'no public exploit identified at time of analysis' - the 8.5 rests on impact and ease, not on evidence of exploitation. Impact is confidentiality-weighted (C:H) with I:N and only A:L, consistent with data extraction (dumping users, order data, secrets) rather than modification or full DoS. The S:C (scope change) is a Patchstack convention for injection that reaches the shared database engine beyond the plugin's own authorization context; it inflates the base score and should be treated cautiously. Overall this is a genuine, actionable authenticated SQLi in an e-commerce plugin - a real priority where low-privilege registration is enabled - but the absence of EPSS/KEV/POC signals means it is not confirmed to be under active or widespread exploitation.

An attacker registers or obtains a low-privilege Contributor account on a WordPress site running WP EasyCart <= 5.9.4, then sends a crafted request to the vulnerable plugin endpoint with SQL metacharacters in an injectable parameter. The injection is executed against the WordPress database, letting the attacker extract sensitive data such as user credentials, password hashes, and customer/order records. No public POC is referenced in the supplied intelligence.