Executive Summary

CVE-2026-54849 is an unauthenticated SQL Injection vulnerability found in the Premmerce Wishlist for WooCommerce plugin versions 1.1.11 and earlier.

This flaw allows attackers to interact directly with the website's database without needing to log in or have any privileges.

Because it is an injection vulnerability, it falls under the OWASP Top 10 category A3: Injection.

The vulnerability has a critical severity score of 9.3 (CVSS v3.1), indicating a high risk to affected systems.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows attackers to execute SQL commands on your website's database without authentication.

Attackers could potentially steal sensitive information stored in the database.

It may also lead to partial denial of service or data corruption, as indicated by the CVSS vector showing high confidentiality impact and low availability impact.

Since the vulnerability is exploitable remotely and without any user interaction, it poses a critical risk to website security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to perform SQL Injection attacks on the Premmerce Wishlist for WooCommerce plugin, potentially leading to unauthorized access and theft of sensitive information from the website's database.

Such unauthorized access and data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Failure to address this vulnerability could result in violations of these regulations, leading to legal and financial consequences for affected organizations.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is an unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce versions 1.1.11 and earlier. Detection typically involves monitoring for suspicious HTTP requests that attempt to exploit SQL Injection flaws.

While specific commands are not provided in the resources, common detection methods include using web application firewalls (WAF) with rules to detect SQL Injection patterns, or analyzing web server logs for unusual query parameters or payloads.

Patchstack has provided a mitigation rule to block attacks until the plugin is updated, which can also aid in detection by logging blocked attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended step to mitigate this vulnerability is to update the Premmerce Wishlist for WooCommerce plugin to version 1.1.12 or later, where the SQL Injection flaw has been patched.

Until the update can be applied, users are strongly advised to implement the mitigation rule provided by Patchstack to block attack attempts targeting this vulnerability.

Useful 0 Not Useful 0