CVE-2026-115607

Summary

The Crowd Favorite DXP ToolKit plugin for WordPress versions through 2.0.1 contains an SQL injection flaw (CWE-89) due to improper neutralization of special SQL elements in user-supplied input, allowing attackers to manipulate database queries remotely.

Exploitability

Exploitation is straightforward for remote attackers as it requires no authentication, no user interaction, and low technical skill given the public nature of SQL injection techniques.

Blast radius

Successful exploitation could lead to full compromise of backend database confidentiality (e.g., extraction of sensitive WordPress data like user credentials or content), limited availability impact via denial-of-service through malformed queries, but no direct integrity loss beyond what the database allows.

Detection

Defenders should monitor WordPress debug logs, web server access logs (e.g., Apache/Nginx), and database query logs for anomalous SQL patterns such as quoted strings concatenated with 'OR 1=1', UNION SELECT statements, or time-based blind indicators like SLEEP() in POST/GET parameters targeting dxp-toolkit endpoints.

Prioritized remediation

Upgrade to version 2.0.2 or later of the Crowd Favorite DXP ToolKit plugin, as this is the first fixed version following the affected range (from n/a through 2.0.1).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.