CVE-2026-42773: eMagicOne Store Manager: Blind SQL Injection
CVE-2026-42773 is a blind SQL Injection flaw (CWE-89) in eMagicOne Store Manager, described as affecting versions through 1.3.2. Patchstack assessed it with a CVSS 3.1 base score of 9.3 (critical). The record shows no fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-42773 describes a blind SQL Injection flaw (CWE-89) in eMagicOne Store Manager. The record was published on 2026-05-25 and the CNA is Patchstack. The cited reference is a Patchstack database entry for a WordPress plugin named store-manager-connector, which suggests the affected component may be a WordPress plugin. This link to WordPress is an inference from the URL.
Impact
The CNA score is 9.3 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. According to that vector, the flaw is reachable over the network with low complexity, requires no privileges or user interaction, and has a high confidentiality impact, a low availability impact and no integrity impact. Blind SQL injection generally lets an attacker infer database content from indirect responses, so exposure of stored data is the main concern.
Affected products and versions
The description states that the product is affected from an unspecified lower bound through version 1.3.2. The structured affected list in the record is empty, so the exact set of affected builds and the lower boundary are unknown.
Exploitation status
CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The EPSS record gives a probability of 0.004 with a percentile of 0.324, dated 2026-10-13. EPSS is a model estimate and is not evidence of exploitation.
Remediation and mitigation
- Inventory all installations of eMagicOne Store Manager and any related connector plugin, and record their versions.
- Check the vendor and Patchstack entries for a release newer than 1.3.2. The record does not provide a fixed version.
- Until a fix is applied, restrict access to administrative and management interfaces. Input validation and web application firewall rules can serve as compensating controls but do not replace patching.
- Confirm that database accounts used by the application follow the principle of least privilege.
Detection guidance
- Review web server and application logs for unusual parameter values or abnormal request patterns targeting store management endpoints.
- Monitor database logs for errors or unexpected query behavior originating from the application account.
- Alert on unexpected changes to application configuration or stored data.
Limitations of the available information
The record lacks a fixed version, a structured affected version range, vendor advisory text beyond the short description, and exploitation telemetry beyond the KEV absence and EPSS data. The link to WordPress is inferred from a URL and is not confirmed by the description. Vendor confirmation is unknown.
Frequently asked questions
Is CVE-2026-42773 being actively exploited?
CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. EPSS gives a model-based probability of 0.004, which is not proof of exploitation.
Which versions are affected?
The description says the product is affected through version 1.3.2, with no lower bound stated. The structured affected list is empty, so the exact range is unknown.
Is there a fixed version?
The record does not list a fixed version. This does not mean no fix exists, so check the vendor and the Patchstack entry for an updated release.
What should administrators do now?
Inventory installations, restrict access to management interfaces, apply least privilege to database accounts, and watch logs while waiting for a vendor release.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.