PT-2026-25303 · Flycart · Upsellwp

Nguyen Ba Khanh · Published 2026-03-13 · Updated 2026-03-14 · CVE-2026-32459

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions flycart UpsellWP versions through 2.2.4

Description The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, specifically a Blind SQL Injection. This allows for potential unauthorized access or manipulation of data through crafted SQL queries. The vulnerability exists within the checkout-upsell-and-order-bumps component of the software.

Recommendations flycart UpsellWP versions through 2.2.4 should be updated to a newer, secure version to address this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32459

Affected Products

Upsellwp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-32459 · Security Note
• https://t.me/CVEtracker/47359 · Telegram Post
• https://twitter.com/TheHackerWire/status/2032551505245732992 · Twitter Post
• https://twitter.com/CVEnew/status/2032831396067365078 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2032605940097089736 · Twitter Post
• https://twitter.com/CveFindCom/status/2032558262374076755 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/checkout-upsell-and-order-bumps/vulnerability/wordpress-upsellwp-plugin-2-2-4-sql-injection-vulnerability?_s_id=cve · Note