CVE Intelligence
Analysis AI-assisted

CVE-2026-25371: King-Theme Lumise Product Designer for WordPress: Unauthenticated Blind SQL Injection

CVE-2026-25371 is a blind SQL injection flaw (CWE-89) in the King-Theme Lumise Product Designer WordPress plugin, rated 9.3 (critical) by Patchstack. The CVSS vector indicates network exploitation without authentication or user interaction, with high confidentiality impact. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25371 describes an SQL injection weakness (CWE-89) in the Lumise Product Designer plugin for WordPress, developed by King-Theme. According to the CNA, Patchstack, the flaw allows blind SQL injection, meaning an attacker can infer database contents from the application's behavior even when query results are not shown directly. The record was published on 2026-03-25 and its NVD status is "Deferred".

Impact

Patchstack assigned a CVSS score of 9.3 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. In practice this means:

  • Exploitable over the network with low complexity, with no privileges and no user interaction required.
  • Changed scope: the impact can extend beyond the plugin itself, for example to the WordPress database it shares.
  • High confidentiality impact: data stored in the database (such as user records, password hashes, order or customer data) could be read.
  • No integrity impact and low availability impact are scored.

The CISA ADP SSVC assessment marks the issue as automatable, with partial technical impact.

Affected products and versions

  • King-Theme Lumise Product Designer (WordPress plugin slug "lumise").

The record is not fully consistent on the version boundary: the description and title state versions < 2.0.9 are affected, while the structured affected-products data lists ≤ 2.0.9. Administrators should treat 2.0.9 itself with caution until the vendor or Patchstack clarifies.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the SSVC exploitation value is "none". No confirmed exploitation appears in the sources consulted. No EPSS score is available. Because the flaw is unauthenticated and automatable, the risk of opportunistic scanning against WordPress sites should be considered meaningful.

Remediation and mitigation

  • Update Lumise Product Designer to the most recent release published by King-Theme; the record does not list a confirmed fixed version, so verify the fix status in the Patchstack advisory.
  • If an update cannot be applied promptly, consider deactivating the plugin on exposed sites.
  • Use a web application firewall or virtual patching rules that block SQL injection patterns targeting plugin endpoints.
  • Ensure the WordPress database account follows least privilege and that backups are current.
  • If compromise is suspected, rotate administrator passwords, API keys and database credentials.

Detection guidance

  • Inventory WordPress installations for the "lumise" plugin and record its installed version.
  • Review web server and WAF logs for unusual requests to Lumise plugin endpoints, especially those with SQL syntax, time-delay patterns or long-running responses typical of blind injection probing.
  • Monitor database logs for anomalous or slow queries originating from the WordPress application.
  • Check for unexpected new administrator accounts or changes to user data.

Limitations of the available information

  • No fixed version is explicitly listed in the record, and the affected range is stated inconsistently (< 2.0.9 versus ≤ 2.0.9).
  • The vulnerable parameter or endpoint is not disclosed in the record.
  • No EPSS data is available, and NVD has not performed its own analysis (status "Deferred").
  • The only scoring comes from Patchstack.

Frequently asked questions

Which plugin is affected by CVE-2026-25371?

The King-Theme Lumise Product Designer plugin for WordPress (slug "lumise"). The description says versions < 2.0.9 are affected, while the structured data lists ≤ 2.0.9.

Does an attacker need to log in?

No. The CVSS vector specifies no privileges and no user interaction, with network access and low complexity.

Is this vulnerability being exploited in the wild?

No confirmed exploitation appears in the sources consulted. It is not in the CISA KEV catalog and the SSVC exploitation value is "none".

What should administrators do?

Update the plugin to the latest vendor release and confirm the fix status in the Patchstack advisory; if that is not possible, deactivate the plugin or apply WAF virtual patching.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.