CVE Intelligence
Analysis AI-assisted

CVE-2026-54849: Premmerce Wishlist for WooCommerce Unauthenticated SQL Injection

CVE-2026-54849 is an unauthenticated SQL injection flaw in the Premmerce Wishlist for WooCommerce plugin, described for versions up to and including 1.1.11. The CNA rated it critical with a CVSS 3.1 base score of 9.3. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54849 describes an unauthenticated SQL injection vulnerability (CWE-89) in the Premmerce Wishlist for WooCommerce plugin for WordPress. The record was published on 2026-06-25 and its source status is Deferred.

Impact

The CNA-provided CVSS 3.1 score of 9.3 reflects a network-reachable flaw that needs no privileges or user interaction and has low complexity. The scope is marked as changed, with high confidentiality impact, no integrity impact and low availability impact. Practical consequences depend on database content and site configuration, which the record does not describe.

Affected products and versions

  • Product: Premmerce Wishlist for WooCommerce (WordPress plugin)
  • Reported range: versions up to and including 1.1.11
  • The record's affected list is empty, so the exact lower bound and any fixed version are unknown.

Exploitation status

This CVE is not listed in the CISA KEV catalog according to the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Identify whether the plugin is installed on any WordPress site and record the installed version.
  • Check the Patchstack entry and the vendor's update channels for a fixed release, since none is listed in the record.
  • If no verified fix is available, consider deactivating the plugin on sites where wishlist functionality is not essential.
  • Limit database account privileges to the minimum needed and keep current, tested backups.

Detection guidance

  • Review web server and application logs for unusual parameters or malformed requests sent to wishlist-related endpoints.
  • Monitor database error messages and unexpected query patterns.
  • Compare plugin files against a known clean copy to detect unauthorized changes.

Limitations of the available information

The record contains no vendor advisory, no affected lower bound, no fixed version, no identification of the vulnerable parameter and no exploitation data. This analysis relies on the CVE description, the CNA score and the Patchstack reference.

Frequently asked questions

Which versions of Premmerce Wishlist for WooCommerce are affected by CVE-2026-54849?

The record describes the issue for versions up to and including 1.1.11. The exact lower bound of the affected range is not stated in the record.

Is there a fixed version available?

The record does not list a fixed version. Check the Patchstack entry and the vendor's update channels for current information.

Is this vulnerability known to be exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.