CVE-2026-57765 is a SQL Injection vulnerability (CWE-89) affecting WP EasyCart versions up to 5.9.0. The issue arises from improper sanitization of input used in SQL commands related to contributor functionality. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute crafted SQL commands. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. The vulnerability affects the confidentiality and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges and monitor for suspicious activity related to SQL injection attempts. Avoid exposing vulnerable versions in untrusted environments.