CVE-2026-42416

Summary

A SQL injection vulnerability in UDesign Core plugin allows authenticated attackers to execute arbitrary SQL commands against the WordPress database, potentially leading to full database compromise and unauthorized access to sensitive user data.

Exploitability

Moderately difficult to exploit as it requires an authenticated user account with subscriber-level privileges, but the attack surface is relatively narrow with predictable input handling.

Blast radius

The impact could be significant across multiple WordPress sites using UDesign Core versions 4.15.0 or earlier, potentially exposing thousands of user accounts and their associated data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to UDesign Core version 4.15.1 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.