CVE-2026-74013: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WordPress.com eShipper Commerce

CVE-2026-74013 is a SQL Injection vulnerability (CWE-89) in WordPress.com eShipper Commerce affecting versions up to 2.16.13. The flaw arises from improper neutralization of special elements used in SQL commands within the subscriber component. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact includes complete confidentiality compromise and partial availability impact, but no integrity impact. There is no vendor advisory or patch information provided to confirm remediation status.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction to fully compromise confidentiality of the affected system and partially impact availability. Integrity is not affected. This could lead to unauthorized data disclosure and potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious activity related to SQL injection attempts.