Now officially on WordPress.org

CVE Database / CVE-2026-9065

CVE

CVE-2026-9065 — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart] < 4.2.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-9065 SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart] < 4.2.1 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Unknown < 4.2.1 4.2.1 2026-05-20 —

CVE-2026-9065

A flaw exists in SureCart's REST API endpoint for integrations, where certain parameters are not properly sanitized when passed to the query builder. Specifically, if a parameter contains a dot or the WordPress table prefix, it bypasses the escaping mechanism and allows an attacker to inject arbitrary SQL into the WHERE clause through UNION-based queries. This vulnerability affects versions of SureCart prior to 4.2.1.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings