The Lumise Product Designer plugin for WooCommerce handles cart data sent as a JSON file by an AJAX checkout handler. In affected versions, the code builds database queries by concatenating the user‑supplied 'id' and 'table' fields directly into the SQL string without quoting or preparing the statement. This flaw, identified as CWE‑89, permits an attacker to inject arbitrary SQL commands, enabling them to read or modify sensitive data such as user accounts, orders, or site configuration.

WordPress sites that have installed the Lumise Product Designer plugin from the King‑Theme vendor, version 2.1.1 or any earlier release, are impacted. The vulnerability lies in the checkout AJAX endpoint that processes cart JSON uploads, and it is not limited to a single user but is accessible to any visitor of the site.

The CVSS score of 7.5 signals a high severity, and the EPSS score of less than 1% suggests low exploitation activity to date. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated visitor can simply upload a maliciously crafted cart JSON file to the checkout endpoint, after which the plugin executes the injected SQL. This exposes the site’s confidentiality and integrity, potentially allowing full data theft or modification.