CVE-2026-9065 affects SureCart versions before 4.2.1 and involves an authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the 'wp-query-builder' where values passed to the 'where()' method are sanitized only if they do not contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot in the payload, an attacker bypasses the escaping logic, enabling arbitrary SQL injection in the WHERE clause and allowing full UNION-based extraction of the database.

Successful exploitation allows an authenticated attacker to perform SQL injection attacks on the SureCart database, potentially extracting sensitive data through UNION-based queries. The vulnerability is critical (CVSS 9.3) and affects the integrity and confidentiality of the database. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should restrict access to the vulnerable REST API endpoint to trusted authenticated users only and monitor for updates from Brainstormforce regarding a security patch. Avoid passing input containing dots or suspicious characters to the affected parameters if possible.