Levelfourdevelopment
Monthly
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
SQL injection in the WP EasyCart WordPress e-commerce plugin (all versions up to and including 5.9.0) lets a low-privileged authenticated user with Contributor role inject arbitrary SQL into backend queries. Reported by Patchstack and rated CVSS 8.5, the flaw allows attackers to read sensitive database contents such as customer records, order data, and WordPress user credential hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
WP EasyCart versions 5.8.13 and earlier are vulnerable to blind SQL injection, allowing authenticated attackers to execute arbitrary SQL queries through improper input sanitization. This vulnerability could enable attackers to extract or manipulate sensitive database information, though code execution is not possible. No patch is currently available for this high-severity vulnerability (CVSS 8.5).
The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
SQL injection in the WP EasyCart WordPress e-commerce plugin (all versions up to and including 5.9.0) lets a low-privileged authenticated user with Contributor role inject arbitrary SQL into backend queries. Reported by Patchstack and rated CVSS 8.5, the flaw allows attackers to read sensitive database contents such as customer records, order data, and WordPress user credential hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
WP EasyCart versions 5.8.13 and earlier are vulnerable to blind SQL injection, allowing authenticated attackers to execute arbitrary SQL queries through improper input sanitization. This vulnerability could enable attackers to extract or manipulate sensitive database information, though code execution is not possible. No patch is currently available for this high-severity vulnerability (CVSS 8.5).
The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.