CVE-2026-9713

Name of the Vulnerable Software and Affected Versions Lumise Product Designer for WooCommerce versions prior to 2.1.2

Description Unauthenticated attackers can perform SQL Injection by manipulating the id and table parameters within an uploaded cart JSON file. This issue occurs during the processing of the checkout AJAX action in the find resource() function, where user-supplied parameters are appended to a raw SQL query without sufficient escaping. Specifically, the id field is interpolated without quotes into a WHERE clause and the table field is interpolated into the FROM clause, bypassing protections like wp magic quotes or $wpdb->prepare(). This allows for the execution of additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 2.1.1. As a temporary mitigation, restrict the ability to upload cart JSON files until the update is applied.