CVE-2026-109925: SQL Injection in Productive Commerce
A high-severity SQL injection vulnerability has been published in the Productive Commerce WordPress plugin. Tracked as CVE-2026-109925 with a CVSS score of 8.6, it affects versions before 1.1.54.
The plugin does not sanitise and escape a parameter before using it in a SQL statement. Unauthenticated attackers can use this to perform SQL injection.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-109925 |
| CVSS Score | 8.6 (High) |
| Affected Plugin | Productive Commerce (WordPress) |
| Affected Versions | Before 1.1.54 |
| Fixed Version | 1.1.54 |
| Authentication Required | None |
| Impact | SQL injection |
| Published | 2026-11-08 |
Why This Matters
On a WordPress store, the database holds customer records, order data, and password hashes for every user. An unauthenticated SQL injection can expose that data, and depending on the query context may allow changes to it.
Remediation
- Update Productive Commerce to 1.1.54 or later.
- Review database and web logs for unusual query strings or error spikes targeting the plugin's endpoints.
- Enable WAF SQL injection rules while patching is in progress.
- Rotate secrets and reset admin passwords if you suspect the database was read.
- Ensure the WordPress database user has only the privileges it needs.