The vulnerability is a second‑order SQL injection in the Shopping Cart & eCommerce Store WordPress plugin. An attacker who can log in with administrator‑level or higher privileges can supply a crafted value for the 'product_order' parameter, which is stored in the ec_pageoption table without sanitization. When the value is later retrieved, it is concatenated directly into a query after only a simple stripslashes call, allowing arbitrary SQL statements to be appended and executed. The result is the ability to read sensitive database contents, but the flaw is limited to authenticated users with elevated privileges and does not grant remote code execution.

The affected product is the Shopping Cart & eCommerce Store plugin for WordPress, versions up to and including 5.9.2. System administrators using these versions should verify the installed plugin version and consider upgrading immediately.

The CVSS score of 4.9 indicates a moderate impact; the EPSS score is unavailable, so current exploitation statistics are unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting there have been no confirmed large‑scale exploitations yet. Because the flaw requires administrator access, the attack surface is constrained to sites with privileged users. Attackers would need to first authenticate using compromised or shared credentials, then submit the malicious 'product_order' payload to the ec_ajax_save_page_options endpoint, and finally wait for a page render that triggers the vulnerable query.