CVE-2026-17589

Name of the Vulnerable Software and Affected Versions Shopping Cart & eCommerce Store versions prior to 5.9.3

Description This issue is a second-order SQL Injection where a payload is first written to the ec pageoption table via the ec ajax save page options handler, which fails to sanitize raw $ POST values. The payload is subsequently retrieved using stripslashes(), bypassing WordPress magic-quotes protection, and concatenated directly into SQL queries during every store page render. Authenticated attackers with administrator-level access and above can use the product order parameter to append additional SQL queries and extract sensitive information from the database.

Recommendations Update to a version newer than 5.9.2. Avoid using the product order parameter until the update is applied.