CVE-2026-121769

Summary

A SQL injection flaw exists in the WP w3all phpBB integration plugin due to improper neutralization of user-supplied input in SQL queries. This allows authenticated low-privilege users to manipulate database queries and exfiltrate sensitive data.

Exploitability

Exploitation requires low-privileged authentication (e.g., a registered WordPress user with minimal permissions) and no user interaction, making it feasible for compromised accounts or weakly secured endpoints.

Blast radius

Successful exploitation could lead to full database compromise including user credentials, personal data, and potentially privilege escalation if administrative data is accessed.

Detection

Defenders should monitor WordPress debug logs and web server access logs for SQL error messages (e.g., 'You have an error in your SQL syntax'), unusual patterns of single quotes or UNION-based payloads in POST/GET parameters targeting wp-admin/admin-ajax.php or plugin-specific endpoints, and repeated failed queries from authenticated users.

Prioritized remediation

Upgrade to WP w3all phpBB version 3.1.10 or later, as the vulnerability is fixed in that release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.