CVE-2026-96330

Summary

This vulnerability allows attackers to perform blind SQL injection attacks against the tagDiv Opt-In Builder plugin, potentially enabling them to extract data from the database without direct output feedback. The flaw occurs due to improper neutralization of special elements in SQL commands.

Exploitability

Exploitation requires a network-accessible endpoint with SQL injection vulnerability, but is relatively straightforward once an attacker identifies the vulnerable parameter and can perform blind inference attacks.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive database information including user credentials, configuration details, and potentially enable further attacks on the WordPress site or underlying infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.7.7 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.