Lumise Product Designer CVE-2026-9713

Exploitation requires that the Lumise Product Designer plugin (≤2.1.1) be installed and active with WooCommerce, and that the vulnerable checkout AJAX action which parses an uploaded cart JSON file be reachable - the attacker must be able to supply the crafted cart JSON so that its 'id' and 'table' fields reach find_resource(). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, so any internet-facing store running the plugin's default checkout flow is exposed. The primary limiting factor is deployment-specific: sites that do not expose the Lumise cart/upload checkout path, or that gate it behind authentication or a WAF, reduce reachability; there is no platform or version constraint beyond the plugin being at or below 2.1.1.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a network-reachable, low-complexity, fully unauthenticated attack with high confidentiality impact but no integrity or availability impact - consistent with a read-oriented data-exfiltration SQLi. There is no EPSS score, no KEV listing, and no POC flagged in the supplied intelligence, so this is currently no public exploit identified at time of analysis rather than confirmed active exploitation; the absence of EPSS means widespread-exploitation probability cannot be quantified from this data. The signals are internally consistent (unauthenticated network SQLi maps cleanly to C:H/I:N/A:N), so this is a genuine priority for any site running the affected plugin, though real-world urgency is tempered by prevalence: the plugin is a niche paid add-on rather than ubiquitous software, meaning exposure is real but not internet-wide. One nuance to verify with the vendor: exploitation depends on the checkout AJAX action accepting an uploaded cart JSON file, so environments that restrict or disable the Lumise cart/upload flow may not be reachable despite the network vector.

An unauthenticated attacker crafts a malicious cart JSON file whose 'table' value points at wp_users and whose 'id' field contains injected SQL, then submits it to the plugin's checkout AJAX action; because find_resource() interpolates both values into a raw query without $wpdb->prepare(), the attacker's appended clauses execute and return password hashes or other sensitive rows. The low attack complexity and lack of authentication (AV:N/AC:L/PR:N) make this scriptable at scale, though no public POC is currently identified.