CVE-2026-12936 describes a SQL Injection vulnerability in the Recurio – Ultimate Subscription for WooCommerce plugin for WordPress. The issue arises from improper neutralization of special elements in the 'data' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with shop manager-level privileges or above can exploit this to append malicious SQL commands to existing queries, potentially extracting sensitive database information. The vulnerability affects all versions up to and including 1.1.3. No official patch or remediation level has been provided yet.

An attacker with shop manager-level access or higher can exploit this vulnerability to execute unauthorized SQL queries, potentially leading to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but it has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only and monitor for suspicious activity related to SQL query manipulation. Avoid using the vulnerable versions in production environments if possible.