CVE-2026-62117

Summary

A SQL injection vulnerability in the Barcode Scanner with Inventory & Order Manager plugin allows authenticated attackers to execute arbitrary SQL commands against the underlying database. This could lead to unauthorized data access, data modification, or potential database compromise.

Exploitability

Exploitation requires an authenticated user account with subscriber privileges, but is relatively straightforward once access is obtained as it involves crafting specific input parameters that are directly passed into SQL queries without proper sanitization.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive customer data, modify inventory records, or potentially escalate privileges within the application's database, affecting multiple users and business operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.13.2 or later which contains the SQL injection fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.