Kadence Shop Kit
Monthly
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.