EIP-2026-114140

This is a technical writeup detailing an unauthenticated SQL injection vulnerability in the Ultimate Product Catalogue WordPress plugin (versions < 3.1.2). The vulnerability exists in the 'Item_ID' POST parameter due to improper sanitization in the 'Process_Ajax.php' file, allowing arbitrary SQL execution.