Wp Easycart EUVD-2026-11949

Valid WordPress user account required. WP EasyCart plugin installed and active on vulnerable version (<=5.8.13). Vulnerable parameter accessible through authenticated admin or user interface accepting unsanitized input.

The CVSS 3.1 score of 8.5 reflects high theoretical risk due to network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), and high confidentiality impact (C:H) with scope change (S:C). However, the real-world risk appears more moderate as there is no evidence of active exploitation (not in CISA KEV), no public proof-of-concept code available, and the EPSS score is not provided suggesting lower exploitation likelihood. The requirement for authentication (PR:L) significantly reduces the attack surface compared to unauthenticated vulnerabilities. While the high confidentiality impact is concerning for an e-commerce plugin handling payment data, the authentication requirement and lack of exploitation evidence suggest this is a priority for patching but not an immediate crisis.

An attacker with a low-privileged WordPress account (such as a customer or subscriber role) could craft malicious SQL injection payloads through vulnerable plugin endpoints to extract sensitive data from the database. Using blind SQL injection techniques, they could systematically extract user credentials, payment information, order details, and other confidential e-commerce data by observing true/false responses or timing delays. While no public proof-of-concept exists, the low attack complexity means a moderately skilled attacker could develop working exploits with standard SQL injection tools.