CVE-2026-109925: Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Q: Which installations are affected?

Productive Commerce versions earlier than 1.1.54 are affected. The provided information does not identify any configuration prerequisite.

Q: Does exploitation require an authenticated WordPress account?

No. The vulnerability can be exploited by unauthenticated attackers.

Q: What should be done to remediate the issue?

Update Productive Commerce to version 1.1.54 or later. The provided information does not describe a workaround if updating is not immediately possible.

Published Nov 8, 2026

Updated

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which installations are affected?

Productive Commerce versions earlier than 1.1.54 are affected. The provided information does not identify any configuration prerequisite.

Does exploitation require an authenticated WordPress account?

No. The vulnerability can be exploited by unauthenticated attackers.

What should be done to remediate the issue?

Update Productive Commerce to version 1.1.54 or later. The provided information does not describe a workaround if updating is not immediately possible.

CVE-2026-109925: Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account?

What should be done to remediate the issue?