{"id":"CVE-2026-109925","kind":"vulnerability","aliases":["CVE-2026-109925"],"related":[],"title":"Productive Commerce WordPress plugin: unauthenticated SQL injection via unsanitised parameter","description":"The Productive Commerce  WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.","summary":"The Productive Commerce WordPress plugin does not sanitise a parameter before using it in a SQL statement. An unauthenticated attacker can inject SQL to read or alter the site's database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","productive-commerce","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check whether the Productive Commerce plugin is installed and its version in the WordPress admin under Plugins\n- Compare the installed version against `1.1.54`","fix":"- Productive Commerce WordPress plugin: move to `1.1.54` or later","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:18+00:00","updated_at":"2026-11-08T06:47:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:18Z","model":"claude-haiku-5-5","output":{"fix":"- Productive Commerce WordPress plugin: move to `1.1.54` or later","reach":"internet","title":"Productive Commerce WordPress plugin: unauthenticated SQL injection via unsanitised parameter","impact":"high","summary":"The Productive Commerce WordPress plugin does not sanitise a parameter before using it in a SQL statement. An unauthenticated attacker can inject SQL to read or alter the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","productive-commerce","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"database contents readable and modifiable by unauthenticated attackers","analyst_note":"Confirm the exact affected parameter and endpoint, and whether the plugin's changelog or WPScan entry names this CVE and its fixed version.","how_to_check":"- Check whether the Productive Commerce plugin is installed and its version in the WordPress admin under Plugins\n- Compare the installed version against `1.1.54`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Productive Commerce WordPress plugin before version 1.1.54 are exposed, since the flaw is reachable without logging in. Sites without this plugin, or running 1.1.54 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4522,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109925':13A,16A '-2026':12A,15A '1.1.54':62C 'allow':77C 'alter':51B 'attack':44B,79C,84C 'commerc':2A,20B,27B,58C 'cve':11A,14A 'databas':55B 'escap':67C 'host':23B 'inject':7A,46B,83C 'packag':17B 'paramet':10A,34B,69C 'perform':81C 'plugin':4A,29B,60C 'product':1A,19B,26B,57C 'productive-commerc':18B 'read':49B 'sanitis':32B,65C 'self':22B 'self-host':21B 'site':53B 'sql':6A,40B,47B,75C,82C 'statement':41B,76C 'unauthent':5A,43B,78C 'unsanitis':9A 'use':36B,71C 'via':8A 'wordpress':3A,24B,28B,59C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Productive Commerce WordPress plugin before version 1.1.54 are exposed, since the flaw is reachable without logging in. Sites without this plugin, or running 1.1.54 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","productivecommerce","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-109925':13A,16A '-2026':12A,15A 'commerc':2A 'cve':11A,14A 'inject':7A 'paramet':10A 'plugin':4A 'product':1A 'sql':6A 'unauthent':5A 'unsanitis':9A 'via':8A 'wordpress':3A","search_b":"'alter':51B 'attack':44B 'commerc':20B,27B 'databas':55B 'host':23B 'inject':46B 'packag':17B 'paramet':34B 'plugin':29B 'product':19B,26B 'productive-commerc':18B 'read':49B 'sanitis':32B 'self':22B 'self-host':21B 'site':53B 'sql':40B,47B 'statement':41B 'unauthent':43B 'use':36B 'wordpress':24B,28B","search_c":"'1.1.54':62C 'allow':77C 'attack':79C,84C 'commerc':58C 'escap':67C 'inject':83C 'paramet':69C 'perform':81C 'plugin':60C 'product':57C 'sanitis':65C 'sql':75C,82C 'statement':76C 'unauthent':78C 'use':71C 'wordpress':59C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109925","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}