CVE-2026-32550: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Liquid Web, LLC Kadence Shop Kit

This vulnerability (CVE-2026-32550) is an SQL Injection flaw in Liquid Web, LLC's Kadence Shop Kit affecting versions up to 3.0.6. The issue arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker with network access and low privileges to execute crafted SQL commands. The CVSS 3.1 score of 8.5 indicates high severity with network attack vector, low attack complexity, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No official patch or remediation level is currently stated, and no known exploits in the wild have been reported.

An attacker can exploit this SQL Injection vulnerability remotely with low complexity and no user interaction to access sensitive data (high confidentiality impact) and cause limited disruption (low availability impact). The vulnerability affects the integrity scope indirectly (no integrity impact reported). This could lead to unauthorized data disclosure within affected Kadence Shop Kit installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, restricting network access to the affected application and applying web application firewall rules to detect and block SQL injection attempts may reduce risk.