Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce
CVE-2026-54849

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Premmerce Wishlist For WooCommerce
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54849?

An unauthenticated SQL injection vulnerability in the Premmerce Wishlist for WooCommerce plugin allows attackers to execute arbitrary SQL commands. This flaw affects versions up to 1.1.11 and poses significant risks as it can potentially expose sensitive data and compromise the integrity of the database. Users of the plugin should take immediate action to update to a patched version to mitigate this security threat. Regular security reviews and plugin updates are essential for maintaining WordPress site integrity.

Affected Version(s)

Premmerce Wishlist for WooCommerce <= 1.1.11

References

https://patchstack.com/database/wordpress/plugin/premmerc...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hhhai | Patchstack Bug Bounty Program
.