CVE-2026-9713 describes an SQL Injection vulnerability in the Lumise Product Designer for WooCommerce WordPress plugin (versions up to 2.1.1). The flaw exists because the 'id' and 'table' parameters from the uploaded cart JSON file are not properly sanitized before being interpolated into a raw SQL query in the find_resource() function. Specifically, the 'id' parameter is inserted without quotes in a numeric WHERE clause, and the 'table' parameter is interpolated into the FROM clause without protection by wp_magic_quotes or $wpdb->prepare(). This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. The CVSS 3.1 base score is 7.5, indicating high severity. No patch or official remediation has been disclosed as of the published date.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The attack vector is network-based with low attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected functionality or plugin. Avoid processing untrusted JSON files containing the 'id' and 'table' parameters. Monitor vendor channels for updates and apply patches promptly once released.