Product Designer For Woocommerce Wordpress | Lumise
Approved changes feed: RSS · Atom
cpe:2.3:a:king-theme:product_designer_for_woocommerce_wordpress_|_lumise:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | King Theme (6382fa8d-2a6c-5d63-96be-107f59a6a19c) |
|---|---|
| Product | Product Designer For Woocommerce Wordpress | Lumise (5e4aec79-e806-5f11-8d5a-ecf840d2664d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9713 |
vulnerable | 2026-07-29 01:12:09.565982 |
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
HIGH (7.5)
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2026-07-23T06:52:34.967Z
Updated: 2026-07-23T14:54:58.178Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.