CVE-2026-88930
8.6 HIGHPublished 2026-10-11 · Updated 2026-10-13
AI risk analysis
- Summary
- The Social Web Suite WordPress plugin has a SQL injection vulnerability because it fails to validate a shared secret parameter and doesn't sanitize input before using it in database queries, allowing unauthenticated attackers to execute arbitrary SQL commands.
- Exploitability
- Exploitation is relatively straightforward as attackers can trigger the SQL injection without authentication, but requires knowledge of the specific plugin endpoint and parameter structure.
- Blast radius
- If exploited, attackers could extract sensitive data from the WordPress database including user credentials, posts, and configuration settings, potentially leading to full site compromise.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 4.1.13 or later which includes proper validation of the shared secret parameter and input sanitization fixes.
sql-injectionwordpressplugin
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-42713
- HIGHCVE-2026-42721
- HIGHCVE-2026-66625
- HIGHCVE-2026-66626
- HIGHCVE-2026-89214
- HIGHCVE-2026-94663
- HIGHCVE-2026-96826
- HIGHCVE-2022-4997
Related by shared AI tags and CWE weakness class. Browse the full archive.