WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability

The SQL Injection vulnerability in Emerce Core poses a significant risk. An attacker could leverage this to bypass authentication mechanisms, directly accessing and modifying sensitive data stored within the database. This includes user credentials, customer information, and potentially even financial data. Successful exploitation could lead to complete compromise of the WordPress site and its associated data. The blind nature of the injection means the attacker doesn't see immediate results, requiring more sophisticated techniques to extract data, but the potential impact remains severe. This vulnerability shares characteristics with other SQL injection flaws, where attackers can manipulate database queries to gain unauthorized access.

Websites utilizing Emerce Core plugin, particularly those with sensitive user data or financial transactions, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially impact others. Legacy WordPress installations with outdated security practices are also at higher risk.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/emerce-core/

• generic web:

curl -I https://example.com/emmerce-core/vulnerable_endpoint?param=';-- -n

• database (mysql):

SELECT SLEEP(5); -- - from the vulnerable endpoint

• wordpress / composer / npm:

wp plugin list | grep emerce-core

• wordpress / composer / npm:

wp plugin status emerce-core

1. 2026-02-20Disclosure

   disclosure

1. Reserviert2025-12-31
2. Veröffentlicht2026-02-20
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

While a direct patch is pending, several mitigation steps can reduce the risk. Implement a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL Injection attempts targeting Emerce Core. Strengthen input validation on all user-supplied data processed by the plugin, ensuring proper sanitization and escaping of special characters. Consider temporarily disabling the Emerce Core plugin if feasible, or restricting access to sensitive areas of the website. Monitor database logs for suspicious SQL queries that might indicate an ongoing attack. After a patch is released, upgrade Emerce Core to the latest version immediately and verify the fix by attempting a SQL injection attack on the vulnerable endpoints.