CVE-2026-109925 PUBLISHED

Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Assigner: WPScan
Reserved: 13.10.2026 Published: 08.11.2026 Updated: 08.11.2026

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Productive Commerce
Versions Default: unaffected
  • affected from 0 to 1.1.54 (excl.)

Credits

  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE