CVE-2026-54849
CriticalCVSS 9.3Summary
The Premmerce Wishlist plugin for WooCommerce versions up to 1.1.11 contains a vulnerability to unauthenticated SQL injection.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in Premmerce Wishlist for WooCommerce
See all- CVE-2026-97273High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- CVE-2026-97268High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- CVE-2025-13440Medium
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Original NVD description (English source)
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS