Executive brief
The Shopping Cart & eCommerce Store plugin for WordPress allows authenticated administrators to inject malicious SQL code through the product_order parameter. An attacker with admin credentials can exploit this second-order SQL injection to extract sensitive data from the website's database, such as customer information, order details, and payment records.
Technical details
This is a second-order SQL injection vulnerability in the Shopping Cart & eCommerce Store WordPress plugin (versions up to 5.9.2). The vulnerability occurs because the ec_ajax_save_page_options handler accepts and stores unsanitized POST parameters directly into the ec_pageoption table. Later, when store pages render, the stored payload is retrieved using stripslashes() (which bypasses WordPress magic-quotes protection) and concatenated directly into SQL queries without parameterized prepared statements. The attack requires administrator-level access to inject the payload, but the payload can then be executed every time a store page is rendered. An attacker can append arbitrary SQL queries to extract sensitive data from the database.
Affected products
- WordPress Shopping Cart & eCommerce Store up to and including 5.9.2
Timeline
- 2026-09-01: disclosed