WP-Lister Lite for eBay EUVD-2026-81509

Requires an authenticated session with the WooCommerce 'Shop manager' role (PR:H) on a site running WP-Lister Lite for eBay version 3.8.11 or earlier; the plugin must be installed and active. Exploitation is remote (AV:N) with low complexity and no user interaction, but the high-privilege prerequisite limits the realistic attacker pool to insiders or those who have already compromised a Shop-manager account. No fixed version is documented, so no patched configuration is confirmed to be safe.

This is a genuine but privilege-gated SQL injection (CWE-89) that lands in the mid-to-high band rather than a top-priority emergency. The vendor CVSS3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L = 7.6) is internally consistent with an authenticated attacker abusing a plugin admin/AJAX action to run injected SQL that escapes the plugin's own tables and reads the entire WordPress database (Scope:Changed, Confidentiality:High). The critical limiting signal is PR:H: exploitation requires the elevated WooCommerce 'Shop manager' role, so this is realistically an insider-abuse or post-compromise/privilege-chaining scenario rather than mass internet-facing exploitation. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so there is no evidence of active exploitation - the 7.6 base score somewhat overstates real-world urgency because it does not reflect how few actors hold Shop-manager access. One inconsistency worth verifying: SQL injection commonly permits writes as well as reads, yet the vendor set I:N; the description text ('SQL Injection') does not confirm read-only behavior, so integrity impact may be understated. No fixed version is stated in the source, which complicates remediation planning.

A user holding the WooCommerce 'Shop manager' role (or an attacker who has compromised such an account) sends a crafted parameter to a WP-Lister Lite for eBay admin/AJAX action; the value is concatenated into a SQL query, letting them UNION/sub-select data from any table and dump WordPress user records and password hashes beyond the plugin's scope. No public exploit code is identified in the provided data, and exploitation is remote but requires an authenticated high-privilege session.