Read the docs
TI-2026-08512 Aliases CVE-2026-9713GHSA-332v-fh8c-j8r7

SQL injection in King-Theme Product Designer for WooCommerce WordPress | Lumise

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
King-ThemeProduct Designer for WooCommerce WordPress | Lumiseup to 2.1.1—No fix listedCNA
  • Product Designer for WooCommerce WordPress | Lumise VendorKing-Theme Affected up to 2.1.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9713
  2. 2026-10-03 Alias added: GHSA-332v-fh8c-j8r7

References

Other 2

  • TI-2020-12054 A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through… CVSS 3.1MEDIUM 6.1
  • TI-2026-20489 WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2020-18872 Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2020-18871 Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control CVSS 3.1HIGH 8.8
  • TI-2026-81679 Path traversal in Lumise for WooCommerce lets attackers read files CVSS 3.1HIGH 7.5
  • TI-2022-00106 Page Builder KingComposer <= 2.9.6 - Open Redirect CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences