CVE-2026-54849 Premmerce CVE debrief

Who should care

WooCommerce users who have installed the Premmerce Wishlist for WooCommerce plugin, especially those with versions up to 1.1.11, should assess their exposure and prioritize updating to a secure version.

Why it matters

CVE-2026-54849 is a critical unauthenticated SQL injection vulnerability in Premmerce Wishlist for WooCommerce that requires immediate attention from WooCommerce users. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise. Users should assess their exposure and prioritize updating to a secure version.

• Potential data breaches due to malicious SQL injection
• System compromise through exploitation of this vulnerability
• Need for immediate patching or mitigation to prevent exploitation

Technical summary

CVE-2026-54849 is an unauthenticated SQL injection vulnerability in Premmerce Wishlist for WooCommerce versions up to 1.1.11. The vulnerability has a CVSS score of 9.3 and is considered critical. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.

Defensive priority

High priority for WooCommerce users

Recommended defensive actions

• Update Premmerce Wishlist for WooCommerce to a version beyond 1.1.11
• Implement web application firewalls to detect and prevent SQL injection attacks
• Regularly review and update plugins and software to prevent exploitation of known vulnerabilities

Evidence notes

The vulnerability was reported by Patchstack and is listed in the NVD database. The evidence is limited to public sources and may not reflect the full scope of affected systems. Defenders should verify the vulnerability's impact on their specific environment and review official advisories for further guidance on mitigation and remediation

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.