CVE-2026-54849: Premmerce Wishlist for WooCommerce unauthenticated SQL injection
CVE-2026-54849 is verified against the affected target vulnerability class: SQLi This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00251.
pruva-verify REPRO-2026-00251 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00251/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Unauthenticated SQL injection exists in Premmerce Wishlist for WooCommerce <= 1.1.11. Reproduce: install WordPress with the vulnerable plugin, send an unauthenticated request containing a SQL injection payload in the affected parameter, and observe database error or extract data.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.