CVE-2026-17589: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in levelfourstorefront Shopping Cart & eCommerce Store

CVE-2026-17589 describes a second-order SQL injection vulnerability in the levelfourstorefront Shopping Cart & eCommerce Store WordPress plugin. The issue arises from insufficient escaping of the 'product_order' parameter and the absence of proper SQL query preparation. Authenticated attackers with administrator privileges can inject malicious SQL payloads that are first stored unsanitized in the ec_pageoption table via the ec_ajax_save_page_options handler. These payloads bypass WordPress magic-quotes protection due to the use of stripslashes() and are later concatenated directly into SQL queries on every store page render, enabling extraction of sensitive database information. The vulnerability affects all versions up to and including 5.9.2. No official patch or remediation level has been published yet.

An attacker with administrator-level access can exploit this vulnerability to execute unauthorized SQL queries, potentially extracting sensitive information from the database. The vulnerability does not affect availability or integrity but compromises confidentiality by allowing data disclosure through SQL injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid using the vulnerable plugin versions if possible.