{"id":"CVE-2026-62117","published":"2026-10-10T20:16:44.060","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-with-inventory-order-manager-plugin-1-13-1-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in the Barcode Scanner with Inventory & Order Manager plugin allows authenticated attackers to execute arbitrary SQL commands against the underlying database. This could lead to unauthorized data access, data modification, or potential database compromise.","exploitability":"Exploitation requires an authenticated user account with subscriber privileges, but is relatively straightforward once access is obtained as it involves crafting specific input parameters that are directly passed into SQL queries without proper sanitization.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive customer data, modify inventory records, or potentially escalate privileges within the application's database, affecting multiple users and business operations.","remediation":"Upgrade to version 1.13.2 or later which contains the SQL injection fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","authenticated","web","inventory"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:06:58.451Z"}}