CVE-2026-62085

Summary

This flaw allows an attacker to inject malicious SQL commands, potentially leading to data theft or manipulation through the WP Activity Log feature in versions 5.6.6 and below.

Exploitability

Exploitation requires administrative privileges and knowledge of the SQL injection vulnerability. The attacker must be able to interact with the WP Activity Log feature.

Blast radius

If exploited, the attacker could gain full control over the database, leading to data loss or unauthorized data access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP Activity Log 5.6.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.