CVE Intelligence
Analysis AI-assisted

CVE-2026-9065: SureCart - SQL Injection

SureCart versions prior to 4.2.1 contain an authenticated SQL injection flaw in the REST API integrations endpoint, scored 9.3 (critical) under CVSS 4.0 by Tenable. The root cause is an escaping bypass in the query builder that can allow SQL to be injected into WHERE clauses. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SureCart versions before 4.2.1 are affected by an authenticated SQL injection vulnerability (CWE-89) in the REST API endpoint '/surecart/v1/integrations/{id}'. According to the record, several parameters can carry the injected input: 'model_name', 'model_id', 'integration_id' and 'provider'. The Tenable advisory is the referenced research source, and the NVD record carries the scoring data.

The record attributes the problem to the query builder ('wp-query-builder'), where input passed to the 'where()' method is escaped only under certain conditions. This is a defect in the input handling logic, not in the database engine.

Impact

The vector reported in the record is CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H, with a base score of 9.3. This indicates high confidentiality and integrity impact on the vulnerable system, no availability impact on it, and high impact on subsequent systems. Because the record describes database extraction, a successful attack could expose stored data, including credentials and customer information held in the WordPress database. The exact data exposed depends on the site configuration, which is not described in the record.

Affected products and versions

  • Product listed in the record: Brainstormforce Surecart.
  • Affected range: versions prior to 4.2.1. The record's lower-bound notation contains a character typo, so the earliest affected release cannot be confirmed from the record.
  • Fixed version: the 'fixes' field is empty. The affected range implies that 4.2.1 is the first unaffected version, but this is an inference and should be verified against the vendor's release notes.

Exploitation status

The CISA KEV catalog does not list this CVE, and the record shows no confirmed active exploitation. The SSVC fields in the record report exploitation as 'none' and automatable as 'no'. The EPSS probability is 0.00435 (percentile 0.35987). These values reflect the record at collection time. No confirmed exploitation appears in the sources consulted, so no claim of active exploitation is made here.

Remediation and mitigation

  • Update SureCart to version 4.2.1 or later, as the affected range suggests, and confirm the installed version on each WordPress site.
  • Until the update is applied, limit access to REST API endpoints for authenticated users to the minimum required, and review accounts that hold elevated privileges.
  • Review account lists and remove unused or excessively privileged accounts, since the vector requires high privileges.
  • Keep database backups and monitor for unexpected changes in the SureCart data tables.

Detection guidance

  • Review web server and application logs for unusual requests to '/surecart/v1/integrations/' with atypical values in the listed parameters.
  • Look for repeated authenticated requests to integration endpoints that return unusually large responses or produce database errors.
  • Audit recently created or recently elevated accounts, particularly those used to access the REST API.
  • Treat detection at this level as a starting point; the record does not provide signatures or indicators of compromise.

Limitations of the available information

The record does not state an official vendor fixed version, does not include the vendor's own advisory, and does not describe the exact conditions under which the query builder behaves differently. The CVSS data comes from Tenable and is duplicated under two provider labels in the record. The EPSS date in the record is later than the publication date, so it should be read with caution. Whether a given site is exposed also depends on whether the SureCart integrations feature is active, which the record does not state.

Frequently asked questions

Which SureCart versions are affected by CVE-2026-9065?

The record lists SureCart versions prior to 4.2.1 as affected. The lower bound of the range contains a typo, so the earliest affected release cannot be confirmed from the record.

Does this vulnerability require authentication?

Yes. The record describes it as an authenticated SQL injection, and the CVSS vector reports high privileges required.

Is this CVE known to be actively exploited?

No. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Update SureCart to version 4.2.1 or later, verify the installed version on each site, and reduce privileged account access until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.