Home / Vulnerability Intelligence / CVE-2026-32459

CVE-2026-32459 - Vulnerability Analysis

HighCVSS: 8.5

Last Updated: March 13, 2026

flycart UpsellWP - SQL Injection

Published: March 13, 2026Updated: March 13, 2026Remote Exploitable

Overview

flycart UpsellWP <= 2.2.4 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

Severity & Score

Severity: High

CVSS Score: 8.5

EPSS Score: 2.1%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version beyond 2.2.4.

References

https://patchstack.com/database/Wordpress/Plugin/checkout-upsell-and-order-bumps/vulnerability/wordpress-upsellwp-plugin-2-2-4-sql-injection-vulnerability?_s_id=cve

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🟠 CVE-2026-32459 - High (8.5) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32459/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32459
Severity: High
CVSS Score: 8.5
Type: sql_injection
Status: new
EPSS: 2.1%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score

2.1%Probability of exploitation in the next 30 days