CVE Database /
CVE-2026-52693
CVE · Critical
CVE-2026-52693 — eCommerce Product Catalog [ecommerce-product-catalog] < 3.5.6
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-52693
|
eCommerce Product Catalog [ecommerce-product-catalog] < 3.5.6 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.3
|
< 3.5.6
|
3.5.6 |
2026-06-09 |
—
|
CVE-2026-52693
The eCommerce Product Catalog Plugin for WordPress contains a vulnerability in versions 3.5.5 and earlier, where user-supplied input is not properly sanitized, allowing malicious actors to inject arbitrary SQL code into database queries, potentially leading to unauthorized data extraction. This weakness arises from inadequate handling of incoming parameters and insufficient modification of the underlying SQL syntax. As a result, attackers can exploit this flaw without requiring authentication.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings