Swift Performance Lite CVE-2026-110651

Requires an authenticated WordPress user holding the author role or higher on a site running Swift Performance Lite prior to 2.3.7.4; the plugin must be installed and active. Exploitation is limited by this authentication requirement - the attacker needs valid author-level (or higher) credentials, so it is not exploitable by anonymous visitors, which substantially narrows the realistic attacker population compared to a pre-auth flaw. No special non-default configuration is described; the vulnerable code path is the plugin's failure to sanitize/escape a value before use in a SQL statement.

This is a CWE-89 SQL injection in the Swift Performance Lite WordPress plugin (before 2.3.7.4) that requires an authenticated account with the author role or above. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, 6.8) signals network reach with low complexity but meaningful privilege requirements. Note a discrepancy: the vector encodes PR:H, yet the description specifies 'author role and above,' which in WordPress is a low-privilege authenticated role - PR:L is more defensible, so treat the PR:H rating with skepticism. EPSS and SSVC data were not provided, and the vulnerability is not listed in CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code exists (WPScan). The net picture is a credentialed, not pre-auth, flaw: real but gated behind obtaining an author-level account, which limits mass exploitation and points toward opportunistic abuse on multi-author sites or post-compromise privilege leverage rather than widespread automated attacks.

An attacker who holds (or phishes/registers into) a WordPress author-level account on a site running Swift Performance Lite below 2.3.7.4 submits a crafted value that is concatenated into a SQL statement without proper sanitization or escaping. Because publicly available exploit code exists (WPScan), the attacker can reliably extract sensitive database contents such as user credentials and secrets. The low attack complexity (AC:L) makes the injection straightforward once author access is held.