eCommerce Product Catalog EUVD-2026-36900

Exploitation requires only that a target WordPress site has the implecode eCommerce Product Catalog plugin installed and active at version 3.5.5 or earlier, with the vulnerable plugin endpoint reachable over HTTP(S) - the default configuration for any public storefront. No authentication, no user interaction, and no special configuration are needed (consistent with CVSS PR:N/UI:N/AC:L). Limiting factors are narrow: the plugin must be installed (a niche plugin compared to WooCommerce), and the affected endpoint must be reachable, which would only be blocked by an upstream WAF, IP allowlist, or maintenance-mode page.

Multiple signals point to elevated real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation - the easiest possible preconditions. The scope change (S:C) with C:H amplifies impact beyond the vulnerable component. However, several signals are missing or weaker: there is no KEV listing, no EPSS score provided, and no public POC referenced - only the Patchstack advisory. The I:N/A:L impact profile is unusual for SQLi (typically I:H is possible via UPDATE/INSERT), suggesting Patchstack scored this conservatively for a read-only injection point. WordPress plugin SQLi historically attracts mass scanning once POCs surface, so defenders should treat this as a high-priority patch despite the absence of confirmed exploitation today.

An unauthenticated attacker scans WordPress sites for the eCommerce Product Catalog plugin, identifies a vulnerable parameter in a product listing or search request, and sends a crafted HTTP request containing a malicious SQL payload (e.g., a UNION-based injection) to extract administrator password hashes from wp_users. The attacker then cracks the hash offline or pivots to session hijacking to take over the WordPress admin account. No POC is referenced in the provided data, but plugin SQLi typically becomes easy to weaponize once the vulnerable parameter is publicly disclosed.