CVE-2026-9713

Description

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the -id- and -table- parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the -id- field is interpolated without quotes into a WHERE clause (numeric context) and -table- is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.