Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-18443 · Microsoft / collected KEV context

cve-program · CVE-2026-18443

• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc660a2d-9f9b-4ec1-b27a-74a41b528afa?source=cve
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.93.0/pro/classes/class-smart-manager-pro-access-privilege.php#L99
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.93.0/pro/classes/class-smart-manager-pro-access-privilege.php#L38
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.93.0/common-core/classes/class-sa-manager-controller.php#L143
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.93.0/pro/classes/class-smart-manager-pro-access-privilege.php#L472
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.92.0/pro/classes/class-smart-manager-pro-access-privilege.php#L99
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.92.0/pro/classes/class-smart-manager-pro-access-privilege.php#L38
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.92.0/common-core/classes/class-sa-manager-controller.php#L143
• https://plugins.trac.wordpress.org/browser/smart-manager-for-wp-e-commerce/tags/8.92.0/pro/classes/class-smart-manager-pro-access-privilege.php#L472
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3712956%40smart-manager-for-wp-e-commerce&new=3712956%40smart-manager-for-wp-e-commerce

No related operational record is retained in the current change model.