EUVD-2026-63315
GHSA-h622-xrc2-7vh7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
SQL injection canonically affords at least limited write capability; I:L rather than I:N better reflects realistic SQLi impact absent vendor confirmation of a read-only query context.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
AnalysisAI
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid WordPress subscriber-level account on the target site, as confirmed by the PR:L metric in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 High score reflects a genuinely significant attack surface: network-reachable, low-complexity SQL injection with scope change and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site running eShipper Commerce 2.16.13 or earlier - possible on any site with open user registration enabled - then sends a crafted HTTP request to the vulnerable plugin endpoint embedding SQL injection payloads. The malicious query traverses the database scope boundary, extracting contents of the wp_users table including hashed passwords and email addresses, which the attacker subsequently uses for credential cracking or account takeover. … |
| Remediation | Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/eshipper-commerce/vulnerability/wordpress-eshipper-commerce-plugin-2-16-13-sql-injection-vulnerability for the confirmed fixed version; no specific patched release number is independently verifiable from the available input data, so the advisory is the authoritative source for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress subscriber and contributor accounts and remove inactive or unauthorized users; enable database query logging focused on eShipper plugin activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eshipper Commerce
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today