A WooCommerce add-on that adds wishlists, product comparison and mini-cart popups shipped with an SQL injection flaw that needs no login to trigger. The patch is out; stores still on older builds are exposed.
What happened
WPScan published details of CVE-2026-109925 on 8 November 2026. The Productive Commerce plugin does not sanitise and escape a parameter before placing it in a SQL statement, and the vulnerable paths are the wishlist and compare handlers. Because those handlers are reachable before authentication, an anonymous request is enough to inject SQL. The CVE record carries a CVSS 3.1 base score of 8.6, with high confidentiality impact and no privileges or user interaction required. Version 1.1.54 fixes it.
Who is affected
Any WordPress site running Productive Commerce below 1.1.54, which in practice means WooCommerce stores that use it for wishlists or product comparison.
- WooCommerce shops on the free or Pro edition of the plugin, whatever the theme
- Stores that expose product, wishlist or compare pages to guests, which is the normal configuration
- Agencies and hosts managing client shops where plugin updates are batched on a monthly cycle
What to do now
Update Productive Commerce to 1.1.54 or later today, then check the site's database for anything you did not put there.
- Run the plugin update from WP Admin, or push 1.1.54 through your management tooling if you run many sites
- Confirm the installed version after the update, since a failed update leaves the old files in place
- Change the WordPress admin passwords and any database credentials stored in wp-config.php on sites that were several versions behind
- Review wp_users and wp_options for unknown administrator accounts and injected scripts
What this means for South African businesses
Wishlist and compare plugins sit on the storefront and are rarely treated as security-critical, so they tend to lag core and WooCommerce updates by months. A read-only injection into a WooCommerce database still hands over customer names, addresses, order history and password hashes, which is a POPIA notification question rather than just a patching chore. Most small South African stores running this plugin will be exposed simply because nobody has looked at it since installation.
Source
Details are in the WPScan vulnerability entry and the CVE-2026-109925 record.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.