# CVE-2026-9065: SureCart SQL injection in REST API integrations endpoint

Source: https://junglewise.ai/threats/cve-2026-9065-surecart-sql-injection-in-rest-api-integrations-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-9065 · Severity: info · CVSS 9.3 · Published 2026-05-20

SureCart is a popular e-commerce platform for WordPress. A security vulnerability in versions prior to 4.2.1 allows an authenticated user with high-level permissions to bypass security filters and access the underlying database. This could lead to the theft of sensitive customer information, transaction records, and other private site data.

Technologies: [SureCart](https://junglewise.ai/threats/technologies/surecart). Vendors: [SureCart](https://junglewise.ai/threats/vendors/surecart).

## Quick answers

**Is CVE-2026-9065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9065 being exploited in the wild.

**How severe is CVE-2026-9065?** Informational severity, with a CVSS score of 9.3, published 20 May 2026.

**Which products and versions are affected?** SureCart < 4.2.1.

**Is there a fix for CVE-2026-9065?** A patch was published on 2026-04-27: Fixed in version 4.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9065 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9065?** Check whether you run SureCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated SQL injection vulnerability exists in SureCart's REST API endpoint '/surecart/v1/integrations/{id}' due to a flawed escaping bypass in the 'wp-query-builder' component. The 'where()' method only applies sanitization via '$wpdb->prepare()' if the input lacks a dot ('.') or the WordPress table prefix. By including a dot in parameters such as 'model_name', 'model_id', 'integration_id', or 'provider', an attacker with high privileges can bypass escaping logic to perform UNION-based SQL injection. This allows for the extraction of arbitrary data from the WordPress database. The issue is resolved in version 4.2.1.

## Affected products

- SureCart SureCart < 4.2.1

## Timeline

- 2026-04-08: other: Report submitted to Patchstack
- 2026-04-21: other: Tenable sends details to vendor
- 2026-04-27: patched: Fixed in version 4.2.1
- 2026-05-20: disclosed: Initial advisory release

## References

- [https://www.tenable.com/security/research/tra-2026-43](https://www.tenable.com/security/research/tra-2026-43)

## Related threats

- [SureCart plugin for WordPress unauthenticated account takeover](https://junglewise.ai/threats/cve-2026-120574-the-surecart-plugin-for-wordpress-is-vulnerable-to)
- [SureCart plugin stored cross-site scripting in comments](https://junglewise.ai/threats/cve-2026-107653-the-surecart-ecommerce-made-easy-for-selling-physical-products)
- [SureCart Stored Cross-Site Scripting in comment parameter](https://junglewise.ai/threats/cve-2026-109224-the-surecart-ecommerce-made-easy-for-selling-physical-products)
- [SureCart WordPress plugin unauthenticated account creation bypass](https://junglewise.ai/threats/cve-2026-75793-surecart-wordpress-plugin-unauthenticated-account-creation-bypass)
- [SureCart plugin privilege escalation and account takeover](https://junglewise.ai/threats/cve-2026-18480-surecart-plugin-privilege-escalation-and-account-takeover)