Barcode Scanner Plugin EUVD-2026-96505

Exploitation requires the Barcode Scanner with Inventory & Order Manager plugin (version 1.13.1 or earlier) to be installed and active on a WordPress site, plus a valid Subscriber-level (or higher) account - per CVSS PR:L the attacker must be authenticated at the lowest WordPress role. The practical risk is amplified on sites that allow open user self-registration, since any visitor can obtain the required Subscriber account; conversely, sites that disable public registration and restrict account creation substantially limit exploitability. No user interaction is required (UI:N) and the flaw is reachable over the network (AV:N).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection requiring only low privileges and no user interaction. The 'Subscriber' qualifier in the title aligns with PR:L: WordPress Subscriber is the lowest authenticated role and is self-registrable on many sites, so the authentication barrier is minimal in practice. No EPSS score, KEV listing, or POC indicator was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a high-CVSS finding driven by impact and ease of access rather than by observed exploitation. The signals are internally consistent (network vector matches a WordPress plugin reachable over HTTP; PR:L matches a subscriber-level flaw), so no contradictions require vendor verification. The main caveat is the real-world exposure: exploitation depends on the specific plugin being installed and on open user registration, and the plugin itself has a modest deployment footprint, which lowers absolute risk despite the high base score. Note also that the vendor-supplied impact of I:N/A:L is conservative for CWE-89, as SQL injection frequently permits data modification.

An attacker registers or uses a low-privileged Subscriber account on a WordPress site running the Barcode Scanner with Inventory & Order Manager plugin (<= 1.13.1), then sends a crafted request to a vulnerable plugin endpoint with malicious SQL in a parameter. Because input is not properly sanitized, the injected query executes against the WordPress database, allowing extraction of sensitive data such as user credentials and secret keys. No public exploit code was identified at time of analysis, and no user interaction is required.