SQL Injection Vulnerability in SureCart by SureCart

CVE-2026-9065

What is CVE-2026-9065?

SureCart versions prior to 4.2.1 are susceptible to authenticated SQL injection through multiple parameters, including 'model_name', 'model_id', 'integration_id', and 'provider', on the REST API endpoint '/surecart/v1/integrations/{id}'. The vulnerability stems from improper handling of SQL query parameters within the 'wp-query-builder' query construction process. Specifically, the issue arises when values passed to the 'where()' method do not undergo adequate sanitization if they contain a dot ('.') or the default WordPress table prefix ('wp_'). By exploiting this flaw, an attacker can insert malicious SQL code into the 'WHERE' clause, thereby gaining the ability to retrieve and manipulate sensitive database information using UNION-based queries.

References