WordPress Plugin Vulnerabilities

Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
productive-commerce
Fixed in 1.1.54

References

CVE
CVE-2026-109925

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Verified
Yes
WPVDB ID
4f6cf8d4-4c76-4cfe-be5c-030fa86e6926

Timeline

Publicly Published
2026-11-06 (about 2 days ago)
Added
2026-11-06 (about 1 day ago)
Last Updated
2026-11-07 (about 7 hours ago)

Other

Published
Title
Published
2026-06-08
Title
Advanced 301 and 302 Redirect < 1.7.0 - Unauthenticated SQL Injection
Published
2020-08-03
Title
Ajax Search Pro < 4.19 - Subscriber+ SQL Injection
Published
2026-04-13
Title
JetEngine < 3.8.6.2 - Unauthenticated SQL Injection via '_cct_search' Parameter
Published
2026-11-06
Title
WP Data Access < 5.5.91 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter
Published
2022-03-29
Title
Users Ultra <= 3.1.0 - Unauthenticated SQL Injection