CVE-2026-42712

Summary

A SQL injection vulnerability in Qode Tours plugin versions 3.1.3.2 and earlier allows authenticated attackers to execute arbitrary SQL commands against the application's database. This could lead to unauthorized data access, modification, or deletion.

Exploitability

Exploitation requires an authenticated user account with subscriber-level privileges, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive customer data, modify tour bookings, and potentially escalate privileges within the WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Qode Tours version 3.1.3.3 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.