CVE-2026-54849: WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the Premmerce Wishlist for WooCommerce WordPress plugin, affecting all versions up to and including 1.1.11. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation gives the attacker read access to the underlying database, exposing stored records, and can cause partial service disruption. No fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is fully server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental pre-conditions.

Blast Radius

• An attacker can read arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, WooCommerce order records, and wishlist data.
• If the database user has access to other schemas or linked tables, the read scope extends beyond the WordPress installation itself.
• The A:L (low availability impact) rating means the injection can also degrade database or application responsiveness, causing partial service disruption for end users.