Vulnerabilities

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.

Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.

CVE-2026-19089 is an unauthenticated arbitrary file upload flaw (CWE-434) in the Product Input Fields for WooCommerce WordPress plugin. When the plugin's accepted file-types setting is left empty — a state its own documentation describes as accepting all file types — the plugin performs no validation of uploaded file types, so anyone can submit files of any kind, including executable scripts, through the product input fields without an account. On servers where the upload directory's access rules are not honoured (i.e., uploaded files can be executed rather than just served), an attacker achieves remote code execution on the web server. All sites running the plugin in versions before 2.0.2 are affected, with critical severity (CVSS 9.8) because no authentication or user interaction is required. A public proof-of-concept is available, but current signals (EPSS ~0.5%, not in CISA KEV) indicate no confirmed in-the-wild exploitation yet.

Do: Update Product Input Fields for WooCommerce to version 2.0.2 or later. As interim mitigation, configure the accepted-types setting to explicitly allow only safe file types (e.g., images) and/or disable PHP execution in the upload directory at the web-server level. Administrators should also check the uploads directory for unexpected PHP files and review logs for unauthenticated upload activity.

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.

Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.