DXP ToolKit CVE-2026-115607

The DXP ToolKit plugin must be installed and active on a target WordPress site, and the affected version must be 2.0.1 or earlier (the advisory states 'from n/a through 2.0.1', so no lower bound is defined and all prior versions should be assumed affected). Per the supplied CVSS vector (PR:N/UI:N), exploitation is unauthenticated and requires no user interaction. The specific vulnerable feature, endpoint, or injectable parameter is not described in the available sources, so the exact request needed to trigger the injection cannot be stated. The principal limiting factor is simply plugin presence and version; no non-default configuration or platform constraint is documented.

The signals are mostly aligned toward elevated priority but rest on a single source. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a remotely reachable, low-complexity, pre-authentication flaw, and the vuln.today Decision label is act_now, which signals urgency and forbids any 'patch later' framing. However, no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no SSVC exploitation/automatable/technical-impact breakdown was supplied - so the act_now label is the primary urgency driver rather than independent exploitation telemetry. Exploitation status is therefore: no public exploit identified at time of analysis (the only reference is the Patchstack advisory, not a PoC). A notable internal tension: the input vector asserts Scope Changed (S:C) and C:H/I:N/A:L, which is an unusual profile for a classic SQL injection (SQLi typically yields confidentiality impact and often integrity impact, with scope frequently unchanged); the description gives no detail on the injectable parameter or sink, so the scope and impact distribution cannot be independently confirmed. Net: treat as a genuine high-priority issue to remediate given the unauthenticated network vector and act_now label, but note the single-source provenance and the absence of EPSS/KEV/PoC data when prioritizing against confirmed-exploited bugs.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the DXP ToolKit plugin (version 2.0.1 or earlier), injecting SQL into a vulnerable parameter to read sensitive database contents such as user records or credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. No public exploit code has been identified at time of analysis; the specific injectable endpoint is not described in the available sources.