CVE-2026-17589: Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

Q: Who can exploit this issue?

An attacker must already be authenticated with administrator-level access or higher in WordPress. The vulnerable plugin must be installed at version 5.9.2 or earlier.

Q: What access or interaction is required for exploitation?

No victim interaction is required. An administrator-level attacker can submit a crafted product_order value through the ec_ajax_save_page_options handler; the stored value is later used when store pages render.

Q: What is the impact of successful exploitation?

The attacker can append SQL to an existing query and extract sensitive information from the WordPress database. The provided information does not indicate an integrity or availability impact.

Q: How can I determine whether an instance may be affected?

Check whether the WordPress Shopping Cart & eCommerce Store plugin is installed and running version 5.9.2 or earlier. Review values stored in the ec_pageoption table, particularly product_order-related page options, for unexpected or suspicious content.

Published Sep 1, 2026

Updated

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ecpageoption table via the ecajaxsavepageoptions handler — which applies no sanitization to raw $POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.

Affected Software

1 affected component

WordPress Shopping Cart & eCommerce Store<=5.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Shopping Cart & eCommerce Store to a version that resolves this vulnerability.
Fixed in 5.9.2

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authenticated with administrator-level access or higher in WordPress. The vulnerable plugin must be installed at version 5.9.2 or earlier.

What access or interaction is required for exploitation?

No victim interaction is required. An administrator-level attacker can submit a crafted product_order value through the ec_ajax_save_page_options handler; the stored value is later used when store pages render.

What is the impact of successful exploitation?

The attacker can append SQL to an existing query and extract sensitive information from the WordPress database. The provided information does not indicate an integrity or availability impact.

How can I determine whether an instance may be affected?

Check whether the WordPress Shopping Cart & eCommerce Store plugin is installed and running version 5.9.2 or earlier. Review values stored in the ec_pageoption table, particularly product_order-related page options, for unexpected or suspicious content.

CVE-2026-17589: Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact of successful exploitation?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact of successful exploitation?

How can I determine whether an instance may be affected?