SQL Injection Vulnerability in Shopping Cart Plugin for WordPress

CVE-2026-17589

What is CVE-2026-17589?

The Shopping Cart & eCommerce Store plugin for WordPress is susceptible to SQL Injection through the 'product_order' parameter, affecting all versions up to 5.9.2. This security issue arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query. Authenticated attackers with administrator access can manipulate queries to extract sensitive database information. Specifically, the payload is written to the ec_pageoption table without proper sanitization, which is later executed unsafely, compromising the security of user data during page renders.

References