Executive brief
The Lumise Product Designer plugin for WooCommerce, which allows customers to create custom product designs on WordPress sites, contains a security flaw that allows unauthorized access to the website's database. By uploading a specially crafted file during the checkout process, an attacker can bypass security controls to steal sensitive information, such as customer data or site configuration details. This could lead to a significant data breach and compromise of the online store's integrity.
Technical details
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection due to insufficient input validation and escaping in the find_resource() function. Specifically, the 'id' and 'table' parameters within an uploaded cart JSON file are processed by the checkout AJAX action and interpolated directly into raw SQL queries. The 'id' field is used without quotes in a WHERE clause, and the 'table' field is used in a FROM clause, bypassing standard WordPress protections like wp_magic_quotes or $wpdb->prepare(). An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands and extract sensitive data from the database. The vulnerability affects all versions up to and including 2.1.1.
Affected products
- King-Theme Lumise Product Designer for WooCommerce up to, and including, 2.1.1
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory