What is the CVSS score of EUVD-2026-47934?

EUVD-2026-47934 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Lumise Product Designer are affected by EUVD-2026-47934?

The Lumise Product Designer for WooCommerce plugin (versions 2.1.1 and earlier) contains an unauthenticated SQL injection vulnerability in its checkout process that allows attackers to extract…

How to fix or mitigate EUVD-2026-47934?

Within 24 hours: identify all WooCommerce installations using Lumise Product Designer and immediately disable or remove the plugin; backup current databases for forensic analysis. Within 7 days: perform incident response assessment to determine if the vulnerability was exploited (review server logs and database access patterns for anomalous SQL queries); notify affected customers if unauthorized access is confirmed. Within 30 days: monitor the plugin vendor for a security patch; if no patch is released, evaluate alternative product designer solutions or implement compensating controls before re-enabling checkout functionality.

Lumise Product Designer EUVD-2026-47934

| CVE-2026-9713 HIGH

SQL Injection (CWE-89)

2026-07-23 Wordfence

GHSA-332v-fh8c-j8r7

WordPress SQLi Product Designer For Woocommerce Wordpress Lumise

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable SQLi via an uploaded JSON file (AV:N/AC:L/PR:N/UI:N); read-oriented data extraction gives C:H with no stated write/DoS impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 08:17 vuln.today

CVE Published

Jul 23, 2026 - 06:52 cve.org

HIGH 7.5

DescriptionCVE.org

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function - the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Lumise Product Designer for WooCommerce WordPress plugin (versions up to and including 2.1.1) allows unauthenticated attackers to extract sensitive database contents by manipulating the 'id' and 'table' parameters inside an uploaded cart JSON file processed by the checkout AJAX action. The flaw stems from unescaped interpolation into a raw SQL query in the find_resource() function, letting attackers append their own SELECT logic. No public exploit is identified at time of analysis, and the CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) affecting a commercial WooCommerce product-personalization plugin distributed via CodeCanyon (vendor king-theme, CPE cpe:2.3:a:king-theme:product_designer_for_woocommerce_wordpress_|_lumise). The root cause is that the checkout AJAX handler parses an attacker-uploaded cart JSON file and passes its 'id' and 'table' fields into find_resource(), which builds a raw SQL string: 'id' is interpolated without surrounding quotes into a WHERE clause (numeric context) and 'table' is interpolated directly into the FROM clause. Neither value is sanitized by WordPress's wp_magic_quotes nor parameterized through $wpdb->prepare(), so the ordinary WordPress input-hardening layer is bypassed because the data arrives via a file rather than standard request superglobals. The numeric (unquoted) and FROM-clause injection points are particularly dangerous because they do not require breaking out of a string literal, making stacked/UNION-style query manipulation straightforward.

RemediationAI

No vendor-released patch version is identified in the available data, so update to any release later than 2.1.1 as soon as the vendor publishes one and monitor the CodeCanyon item page (https://codecanyon.net/item/lumise-product-designer-woocommerce-wordpress/21222684) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7555a1-18dc-4b00-81f6-b26706cfb573?source=cve) for a fixed build. As compensating controls until a patch is confirmed, deploy a WAF rule (Wordfence or equivalent) to inspect and block the checkout AJAX action's uploaded cart JSON for SQL metacharacters in the 'id' and 'table' fields, restrict or disable the Lumise product-designer/cart-upload feature on public-facing stores if the personalization workflow is not business-critical (trade-off: customers lose custom-design checkout), and place the site behind access controls or rate limiting on the AJAX endpoint. Because the injection is read-oriented, also review database privileges of the WordPress DB user to limit the blast radius of data extraction, and audit logs for anomalous checkout AJAX requests.