CVE-2026-32422

The WP EasyCart plugin for WordPress, versions 5.8.13 and earlier, contains a blind SQL injection vulnerability. The root cause is improper neutralization of special elements used in an SQL command ('SQL Injection'), allowing an attacker to inject arbitrary SQL queries through user-supplied input fields [1].

Exploitation does not require authentication, making it accessible to any remote attacker. By sending crafted requests, an attacker can perform blind SQL injection, which may be leveraged to extract sensitive information from the database, such as user credentials or other stored data. This vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites [1].

The impact is high, as a successful attack can lead to direct interaction with the database, potentially resulting in data theft and further compromise of the WordPress site [1].

Patchstack has published a security advisory and the vulnerability is patched in version 5.8.14. Users are strongly advised to update immediately. For those unable to update, consulting a hosting provider or web developer is recommended [1].