CVE-2026-74013

HighCVSS 8.5

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

SQL Injection vulnerability in eShipper Commerce plugin versions up to 2.16.13, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

Risk Assessment

Risk of unauthorized access to database data, modification or deletion, potentially leading to confidentiality and integrity breaches.

Recommendation

Update the eShipper Commerce plugin to the latest version that includes a fix eliminating the SQL Injection vulnerability.

Other vulnerabilities in eShipper Commerce

CVE-2026-39689Medium
The eShipper Commerce plugin for WordPress up to version 2.16.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.