Dinatur CVE-2026-12983

No special conditions are required for the SQL injection path - exploitation targets any default WordPress installation with the Dinatur plugin (≤1.18) installed and active, from the network, with no credentials. The Dinatur plugin must be installed and active (not just present); no non-default configuration is required. For the truncation path, the same applies: no authorization check exists, so any unauthenticated HTTP request reaching the handler triggers the destructive operation. Exploitation is limited only by the plugin's installation base - sites not running Dinatur are unaffected. There is no requirement for a logged-in user, no required interaction from an administrator, and no platform-specific constraint beyond WordPress running PHP with the plugin active.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, score 8.6) captures only the confidentiality impact of the SQL injection path and appears to omit the integrity and availability impact of the unauthenticated truncation primitive - a significant undercount. The attack requires no credentials, no user interaction, and no special configuration beyond the plugin being installed and active, placing real-world exploitation complexity at the absolute floor. No EPSS data was supplied in the intelligence package, and the CVE is not listed in CISA KEV, so widespread automated exploitation is not confirmed. However, the combination of a network-accessible, zero-authentication attack surface and an irreversible data-destruction primitive (truncation) elevates operational risk well above what the I:N/A:N metrics suggest. For sites running this plugin, the effective risk is critical rather than high, because data loss from truncation is not recoverable without backups.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the Dinatur plugin's vulnerable handler, injecting a SQL payload into an unsanitized parameter to enumerate and extract WordPress user credentials, email addresses, or other sensitive table contents. Separately - or in the same request - the attacker triggers the unguarded truncation operation, wiping the plugin's database tables and destroying stored data with no prior authentication. No exploit code has been publicly identified at time of analysis, but the attack requires only a standard HTTP client and basic SQL injection knowledge.