CVE-2026-94124 is an SQL Injection vulnerability (CWE-89) affecting WP EasyCart versions up to 5.9.4. The vulnerability arises from improper neutralization of special elements used in SQL commands within the contributor functionality. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits are reported in the wild. No patch or remediation information is provided in the available data.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute arbitrary SQL commands. This can lead to a complete loss of confidentiality of the database contents and partial denial of service. Integrity is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting contributor privileges and limiting database exposure may reduce risk.