Security Bulletin — July 23, 2026: Two Login-Free Flaws in Shop and Form Plugins — SQL Injection in Lumise Product Designer (WooCommerce) and Stored XSS in FormCraft (CVE-2026-9713 & CVE-2026-7232)

This is our daily security overview, in which we review the published vulnerabilities and highlight those that are actually relevant for the operation of WordPress websites, online shops, and PHP applications. Every statement has been verified against the underlying primary source and linked at the end of the respective section. Where a corrected release was not verifiable at the time of publication, we say so plainly rather than guess at a number. The two entries freshly published today differ from the previous days’ contributor flaws in one decisive respect: they need no account. Both can be triggered from the outside without any login at all — one reads data out of the database, the other plants persistent script code. It is precisely this absence of preconditions that lifts them above the mass of medium-severity reports.

Unauthenticated SQL Injection in Lumise Product Designer for WooCommerce (CVE-2026-9713)

The Lumise Product Designer for WooCommerce is a commercial extension plugin (vendor King-Theme, distributed via CodeCanyon) that lets shop operators offer their customers a graphical product designer — for example to print textiles or mugs right from the cart. In all releases up to and including version 2.1.1, the plugin processes the cart JSON uploaded during checkout without securing its id and table fields. Both values land in the find_resource() function directly inside a raw, hand-assembled SQL query: id is inserted without quotes into a WHERE clause (numeric context) and table into the FROM clause — neither value passes through $wpdb->prepare(). This lets an attacker without a login append their own SQL fragments to the existing query and thereby read data out of the shop database. At CVSS 7.5 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the severity is high; the focus is on reading confidential data, not on manipulation. The attack runs over the regular checkout path — that is, over a function every visitor to a shop can reach. Important for practice: a corrected version was not documented in any primary source at the time of this bulletin (the plugin is distributed commercially rather than via wordpress.org, and neither NVD nor the vendor changelog named a fixed release). Anyone running 2.1.1 or older should check the vendor’s advisories for an update and, until then, restrict access to the affected checkout route via a web application firewall or temporarily deactivate the plugin.

Sources: NVD — CVE-2026-9713 · Wordfence — CVE-2026-9713

Unauthenticated Stored XSS in FormCraft via Matrix Field Keys (CVE-2026-7232)

FormCraft is a widely used commercial form builder for WordPress. In all versions up to and including 3.9.14, the composite keys of a matrix field can be used to plant script code permanently — and to do so without a login. At the core of the problem: sub-keys such as field2_0 or field2_1 never run through the server-side sanitization loop and are stored unchanged via $wpdb->insert(). A second path bypasses the intended client-side protection — matrix values arrive from the server as an array and are routed past the DOMPurify check before being written into the document; on top of that, an html_entity_decode() reverses the htmlentities() escaping applied on submission and restores the payload. The severity is CVSS 7.2 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The S:C in the vector is notable: the flaw can cross the boundary of its original security scope — stored code is later executed in the browser of whoever opens the affected view, potentially a logged-in administrator. Unlike the SQL injection above, a corrected release is available here: since NVD gives the affected range as “up to and including 3.9.14,” version 3.9.15 is the first cleaned-up release (the vendor changelog records an XSS fix there). Anyone running a current FormCraft version is already protected; older installations should be updated.

Sources: NVD — CVE-2026-7232 · FormCraft — Changelog

Follow-up: wp2shell Core Flaw Now Actively Exploited (CVE-2026-60137)

A brief but important follow-up on the “wp2shell” chain we reported on last week: the SQL injection half of the chain — CVE-2026-60137, the insufficient protection of the author__not_in parameter in WP_Query — was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 22 and is flagged there as actively exploited. A theoretical risk has thereby become a documented attack in the wild. The affected WordPress core branches are those before 6.8.6, 6.9.5, and 7.0.2; anyone who has not yet updated to one of these releases should do so now without further delay. As an immediate measure without a patch, access to the batch route (/wp-json/batch/v1) can be blocked at the firewall.

Sources: NVD — CVE-2026-60137 · NVD — CVE-2026-63030

Unsure whether you are affected? Get in touch.

---

This notice serves security-awareness purposes. The official advisories of the respective vendor and the primary sources linked above are always authoritative.