Customer Engagement System CVE-2026-115224

Requires an authenticated WordPress administrator account (CVSS PR:H). The vulnerable action is specifically saving a popup's page and category visibility rules, where request-supplied ID values are concatenated into the INSERT statement without parameter binding or integer casting. The primary limiting factor is the administrator privilege requirement, which sharply narrows the realistic attacker population since administrators already possess extensive database access through legitimate WordPress features; there is no user-interaction or non-default-configuration requirement beyond having the Customer Engagement System plugin (before 2.0.2) installed and active.

This is a genuinely low-priority issue despite being a network-vector SQL injection. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, base 4.1) requires PR:H - an already-authenticated WordPress administrator - which is the dominant limiting factor: an administrator can typically read the database through legitimate functionality already, so the real privilege escalation here is marginal. Impact is confined to confidentiality at Low (C:L) with no integrity or availability effect, consistent with a read-only database-disclosure flaw. The exploitation-probability signals reinforce low urgency: EPSS is 0.18% (7th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified in the input (the WPScan reference is an advisory, not verified working exploit code). Exploitation status: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - routine patching, not act_now or emergency. Note one modeling tension to verify: the vector sets S:C (scope changed), presumably because injection in the plugin exposes the entire WordPress database beyond the plugin's own tables; a reviewer could reasonably argue S:U since it is the same security authority (the WordPress DB). No signals conflict in a way that raises risk - all point to a low-real-risk, admin-only information-disclosure bug.

An authenticated WordPress administrator (or an attacker who has compromised an admin account) creates or edits a popup and supplies crafted page/category visibility-rule ID values; because those IDs are concatenated directly into an INSERT statement without parameter binding or integer casting, the attacker injects SQL that reads arbitrary WordPress database contents. No public exploit code was identified in the available data, and exploitation requires an existing high-privilege (administrator) account, so the practical attacker set is narrow.