CVE-2026-81420

Summary

The Tcard WP WordPress plugin has a SQL injection vulnerability in its unauthenticated AJAX actions that allows attackers to execute arbitrary SQL commands without needing authentication. This is particularly dangerous because it affects unauthenticated users and can lead to data exposure or manipulation.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and leverages an existing AJAX endpoint, though it may require some reconnaissance to identify the vulnerable parameter.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive data from the WordPress database, potentially including user credentials, posts, or other critical information, affecting all sites running the vulnerable plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.8.1 or later which contains the fix for the SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.