PT-2026-25303 · Flycart · Upsellwp

Nguyen Ba Khanh · Publicado 2026-03-13 · Atualizado 2026-03-14 · CVE-2026-32459

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions flycart UpsellWP versions through 2.2.4

Description The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, specifically a Blind SQL Injection. This allows for potential unauthorized access or manipulation of data through crafted SQL queries. The vulnerability exists within the checkout-upsell-and-order-bumps component of the software.

Recommendations flycart UpsellWP versions through 2.2.4 should be updated to a newer, secure version to address this issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-32459

Produtos afetados

Upsellwp

Referências · 7

• https://t.me/CVEtracker/47359 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2032551505245732992 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032831396067365078 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32459 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2032605940097089736 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2032558262374076755 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/checkout-upsell-and-order-bumps/vulnerability/wordpress-upsellwp-plugin-2-2-4-sql-injection-vulnerability?_s_id=cve · Nota