CVE-2026-55684

Summary

A SQL injection vulnerability in WeGIA's billing generation endpoint allows unauthenticated attackers to execute arbitrary SQL commands against the database, potentially leading to full data compromise including member, employee, and credential information.

Exploitability

The vulnerability is highly exploitable with no authentication required, as the endpoint uses extract($_REQUEST) which directly imports all POST parameters into variables, making it trivial for an attacker to inject malicious SQL through any of the interpolated fields.

Blast radius

The impact could be severe across the entire charitable institution's database, affecting billing records, member information, employee credentials, and potentially allowing attackers to delete critical database tables or escalate privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.8.6 immediately to fix this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.