CVE-2026-42717

Summary

A SQL injection vulnerability in Leyka plugin versions up to 3.32.3 allows authenticated administrators to execute arbitrary SQL commands, potentially leading to full database compromise and unauthorized access to sensitive user data.

Exploitability

Exploitation requires an authenticated administrator account with access to the plugin's admin interface, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to extract all user data, modify database records, and potentially escalate privileges within the WordPress environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Leyka version 3.32.4 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.