CVE-2026-9713: Lumise Product Designer SQL Injection Flaw

CVE-2026-9713 Overview

CVE-2026-9713 is an unauthenticated SQL Injection vulnerability in the Lumise Product Designer for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.1.1. Attackers can inject arbitrary SQL through the id and table parameters contained in the uploaded cart JSON file processed by the checkout AJAX action. The vulnerable find_resource() function interpolates these parameters directly into raw SQL without calling $wpdb->prepare() or applying wp_magic_quotes. This allows unauthenticated remote attackers to append SQL statements and extract sensitive data from the WordPress database, including user credentials and order records.

Critical Impact
Unauthenticated attackers can extract sensitive database contents from any WordPress site running Lumise Product Designer 2.1.1 or earlier without any user interaction.

Affected Products

Lumise Product Designer for WooCommerce plugin for WordPress
All versions up to and including 2.1.1
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2026-07-23 - CVE-2026-9713 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9713

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] rooted in the plugin's checkout AJAX handler. When a user submits a cart, the plugin accepts a JSON file containing user-supplied id and table values. These values flow into the find_resource() function, which builds a raw SQL query by string concatenation. The id parameter is interpolated without quotes into the WHERE clause in a numeric context, and the table parameter is interpolated directly into the FROM clause. Because neither value is sanitized nor bound through $wpdb->prepare(), attackers can break out of the intended query structure and append arbitrary SQL.

Root Cause

The root cause is missing input validation and unsafe query construction inside find_resource(). WordPress typically applies wp_magic_quotes to superglobals, but the parameters here originate from an uploaded JSON file and bypass that layer entirely. The developer trusted the JSON-supplied values as internal identifiers and concatenated them into the SQL string. Because the table value controls the target table and id controls filtering in a numeric context, the injection point offers full flexibility for UNION-based data extraction.

Attack Vector

Exploitation requires no authentication and can be performed remotely over the network. An attacker crafts a malicious cart JSON file containing SQL payloads in the id or table fields and uploads it to the checkout AJAX endpoint. The injected SQL executes with the database privileges of the WordPress user, typically granting read access to all WordPress tables including wp_users and wp_usermeta. Attackers can chain UNION SELECT payloads through the numeric id context to exfiltrate password hashes, session tokens, and personally identifiable information from order records.

Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-9713

Indicators of Compromise

POST requests to the plugin's checkout AJAX action containing JSON payloads with SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the id or table fields.
Unexpected outbound database queries referencing wp_users, wp_usermeta, or non-standard table names sourced from user input.
WooCommerce error log entries showing SQL syntax errors originating from find_resource().

Detection Strategies

Inspect web server access logs for AJAX requests targeting the Lumise checkout action with abnormally large or malformed JSON bodies.
Deploy WAF rules that flag SQL metacharacters (', --, /*, UNION) inside multipart uploads submitted to WordPress AJAX endpoints.
Enable MySQL general query logging temporarily to identify malformed queries containing attacker-controlled table names.

Monitoring Recommendations

Alert on repeated 500-series responses from admin-ajax.php where the action parameter targets the Lumise plugin.
Monitor for sudden spikes in database read volume from the WordPress user, particularly against user and order tables.
Track file uploads to WooCommerce checkout endpoints originating from unauthenticated sessions.

How to Mitigate CVE-2026-9713

Immediate Actions Required

Disable the Lumise Product Designer for WooCommerce plugin until a patched version above 2.1.1 is installed.
Rotate all WordPress administrator credentials, API keys, and WooCommerce secrets that may have been exposed via the database.
Audit wp_users and wp_options for unauthorized accounts or modified siteurl values.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Site administrators should monitor the vendor listing on Codecanyon Product Designer Tool for a release that addresses find_resource() and applies $wpdb->prepare() with proper placeholders for both the id and table parameters.

Workarounds

Block requests to the Lumise checkout AJAX action at the WAF or reverse proxy until the plugin is patched or removed.
Enforce an allow-list at the application layer that restricts the table parameter to known internal table names before it reaches the query builder.
Restrict the WordPress database user to the minimum privileges required, preventing access to non-WooCommerce tables where practical.

bash

# Example nginx rule to block the vulnerable AJAX action pending patch
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "lumise") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}