CVE-2026-32422

High

Published: 13 March 2026

Published

13 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0023 13.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-32422 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-32422 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, specifically enabling Blind SQL Injection, in the WP EasyCart WordPress plugin developed by levelfourdevelopment. The flaw affects all versions of WP EasyCart up to and including 5.8.13. It has been assigned CWE-89 and a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating high severity due to network accessibility, low attack complexity, and significant confidentiality impact.

The vulnerability can be exploited by low-privileged authenticated users (PR:L) remotely over the network without user interaction. Attackers can leverage the Blind SQL Injection to extract sensitive data from the database, achieving high confidentiality impact (C:H) such as unauthorized access to user information or other backend data, alongside low availability impact (A:L) and a change in scope (S:C) that amplifies the consequences.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-easycart/vulnerability/wordpress-wp-easycart-plugin-5-8-13-sql-injection-vulnerability?_s_id=cve provides further details on the vulnerability, including mitigation recommendations for affected WordPress installations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-11949

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Blind SQL injection in internet-facing WordPress plugin directly enables T1190 (exploit of public-facing app by authenticated low-priv user) and subsequent extraction of data from backend databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0