What the vulnerability does
01Description
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Explanation of Vulnerability in Simple Terms
02Summary
The Product Designer for WooCommerce plugin contains a SQL injection vulnerability in versions up to 2.1.1. An attacker can query the site's database directly without authentication to extract sensitive data, including user credentials and payment information. The vulnerability requires no user interaction and can be exploited over the network.
What an attacker can do
03Attacker Capabilities
Extract sensitive data from the site's database, including user credentials and payment information.
Potential impact on your site
04Site Impact
Customer data, user credentials, and payment information stored in the database can be stolen by unauthenticated attackers.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 23, 2026
CVE published
July 23, 2026
Record updated
