Critical SQL Injection Vulnerability Discovered in ReadyEcommerce (CVE-2026-63106)

A critical unauthenticated SQL injection vulnerability, CVE-2026-63106, has been identified in ReadyEcommerce versions prior to 4.5.2. The flaw exists in the product listing API, where the rating parameter is unsanitized and directly concatenated into a MySQL HAVING clause in ProductController.php. This vulnerability allows attackers to perform time-based blind SQL injection, potentially extracting sensitive database contents such as user credentials and administrator password hashes. The database connection runs with root privileges, increasing the risk of file system access. Currently, there is no public proof-of-concept or evidence of active exploitation. Users are advised to upgrade to version 4.5.2 or later and implement security best practices. A CVSS score of 9.8 has been assigned, indicating a critical threat level. The vulnerability was first disclosed on August 10, 2026.

Key Points: • CVE-2026-63106 is a critical SQL injection vulnerability with a CVSS score of 9.8. • The flaw affects ReadyEcommerce versions before 4.5.2, allowing unauthenticated access. • No public proof-of-concept exploits are available, but immediate patching is recommended.