CVE-2026-12936

Name of the Vulnerable Software and Affected Versions Recurio – Ultimate Subscription for WooCommerce versions prior to 1.1.4

Description This issue involves a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to interfere with the queries that an application makes to its database. Authenticated attackers with shop manager-level access or higher can append additional SQL queries to existing ones via the data parameter to extract sensitive information from the database. This is caused by insufficient escaping of the user-supplied parameter and a lack of sufficient preparation of the SQL query.

Recommendations Update Recurio – Ultimate Subscription for WooCommerce to version 1.1.4 or later. As a temporary mitigation, restrict access to the data parameter for users with shop manager-level permissions until the update is applied.