Description

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler — which applies no sanitization to raw $_POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-01T05:17:08.973Z",
  "pubdate": "2026-09-01T05:17:08.973Z",
  "executiveSummary": "The Shopping Cart & eCommerce Store plugin for WordPress is susceptible to a second-order SQL injection vulnerability affecting versions up to and including 5.9.2.\nThe vulnerability arises from improper handling of user-supplied data within the 'product_order' parameter, which is processed by the ec_ajax_save_page_options handler without sanitization.\nThis flaw allows authenticated attackers with administrative privileges to inject malicious SQL payloads that are stored in the ec_pageoption database table.\nWhen subsequent store pages are rendered, the application retrieves the stored payload and concatenates it directly into SQL queries, leading to unauthorized database execution.\nThe impact includes the potential for sensitive information disclosure, data manipulation, or unauthorized database access via the underlying WordPress infrastructure.\nExploitation requires administrative-level authentication, limiting the attack surface to malicious actors who have already compromised or possess administrative credentials within the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is a failure to properly sanitize input at the entry point combined with the insecure concatenation of stored data into SQL queries during the page rendering process.\nThe 'product_order' parameter is accepted via the ec_ajax_save_page_options handler. This function fails to sanitize or validate raw $_POST data before committing it to the ec_pageoption table in the database.\nBecause the input is stored directly, it acts as a persistent malicious payload. The vulnerability is characterized as second-order because the malicious impact occurs only after the data is retrieved and processed by the application's rendering logic.\nDuring the rendering of store pages, the application retrieves the previously saved values and applies the stripslashes() function. This process effectively bypasses WordPress's native magic-quotes protection mechanisms, exposing the raw, unsanitized SQL payload.\nThe retrieved payload is then concatenated directly into a SQL query. Because the query lacks parameterization or the use of prepared statements, the database engine executes the injected SQL command alongside the intended query.\nAn authenticated administrator can inject arbitrary SQL fragments, enabling them to query other tables within the WordPress database, perform data exfiltration, or modify existing data structures through standard SQL injection techniques.\nThe vulnerability persists across all versions up to and including 5.9.2. Since the payload is triggered upon rendering store pages, the exploitation occurs automatically whenever the affected administrative configuration is loaded or displayed to the frontend, resulting in consistent, predictable execution of the attacker's payload."
}