Description

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-23T08:16:25.390Z",
  "pubdate": "2026-07-23T08:16:25.390Z",
  "executiveSummary": "The Lumise Product Designer for WooCommerce plugin for WordPress suffers from an unauthenticated SQL Injection vulnerability in versions up to, and including, 2.1.1. This security flaw stems from inadequate sanitization and escaping of user-supplied input contained within an uploaded cart JSON file processed by the checkout AJAX action. Specifically, the 'id' and 'table' parameters are dynamically concatenated directly into a raw SQL query inside the find_resource() function without employing proper parameterization or sanitization mechanisms such as $wpdb->prepare().\nAn unauthenticated remote attacker can exploit this vulnerability by crafting a malicious JSON payload containing SQL injection sequences and uploading it through the checkout process. Successful exploitation allows an attacker to manipulate the underlying database queries, enabling them to extract sensitive information stored within the WordPress database. Given that the vulnerability requires no authentication and targets an AJAX endpoint, the risk implications are severe, potentially leading to total compromise of application data integrity and confidentiality.",
  "technicalDetails": "The vulnerability resides within the find_resource() function of the Lumise Product Designer for WooCommerce plugin, affecting all versions up to and including 2.1.1. The flaw is rooted in insecure handling of user-supplied data extracted from an uploaded cart JSON file during the checkout AJAX action. Two specific parameters, 'id' and 'table', are parsed from the JSON input and unsafely appended directly into raw SQL queries.\nSpecifically, the 'id' parameter is interpolated without quotes into a WHERE clause, establishing a numeric SQL context, while the 'table' parameter is directly interpolated into the SQL FROM clause. Neither of these parameters benefits from adequate input validation, nor are they protected by wp_magic_quotes or passed through the WordPress database abstraction layer's preparation method, $wpdb->prepare(). Because the query construction relies on direct string concatenation, the input context is left entirely exposed to malicious manipulation.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a specialized cart JSON file containing malicious SQL injection payloads embedded within the 'id' or 'table' fields. Second, the attacker submits this payload to the checkout AJAX action processed by the vulnerable plugin. Third, the Lumise plugin reads and decodes the uploaded JSON file, extracting the unescaped parameters and passing them directly to the find_resource() function. Fourth, the vulnerable function concatenates these parameters into a raw SQL statement executed against the database. Finally, the injected SQL commands are evaluated by the database management system, allowing the attacker to append additional SQL queries, modify the query logic, and extract sensitive information from the database through error-based, union-based, or boolean-based data retrieval techniques."
}