Executive brief
WP EasyCart is a popular WordPress plugin used to manage e-commerce stores and shopping carts. A security flaw allows users with 'Contributor' level access to execute unauthorized database commands. This could lead to the theft of sensitive customer information or disruption of the online store's operations.
Technical details
The WP EasyCart plugin for WordPress is vulnerable to SQL Injection in versions up to 5.9.0 due to insufficient escaping of user-supplied input and lack of sufficient preparation on existing SQL queries. This vulnerability allows authenticated attackers with Contributor-level permissions or higher to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database. The attack is reachable over the network and does not require user interaction. As of the advisory date, no official patch has been released.
Affected products
- Levelfourdevelopment WP EasyCart <= 5.9.0
Timeline
- 2026-04-22: disclosed: Reported by HaiND
- 2026-07-02: advisory: Published by Patchstack