EUVD-2026-42802
GHSA-85wm-6f94-p7hm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Low-priv authenticated attacker (PR:L) exploits a network-reachable action but the payload needs an admin to view the report (UI:R); arbitrary SQL yields full C/I/A impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify stored SQL queries, which can lead to privilege escalation via arbitrary SQL execution when the modified query is viewed by an administrator.
AnalysisAI
Privilege escalation in the WP Business Intelligence Lite WordPress plugin (all versions through 3.2.0) allows authenticated Subscriber-level users to tamper with stored SQL queries because the plugin fails to enforce a capability/authorization check on the query-modification action (CWE-862). When an administrator later views the maliciously altered query, the attacker's arbitrary SQL executes in the admin context, enabling account takeover or full site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through the Wordfence threat intelligence program.
Technical ContextAI
The affected component is a WordPress plugin (wp-business-intelligence-lite) that lets site operators define and store SQL queries and render their results inside the wp-admin dashboard. The vulnerable code path is in Admin/Menu/Query.php (referenced at line 122) and the plugin's Loader.php (line 81), where the handler that saves or modifies a stored query registers and executes without validating that the requesting user holds the appropriate administrative capability. This is a classic CWE-862 (Missing Authorization) defect: authentication is required but the authorization gate that should restrict the action to administrators is absent, so any logged-in role down to Subscriber can invoke it. Because the stored query is later run verbatim by the plugin when an administrator opens the reporting view, the vulnerability behaves as a stored/second-order SQL injection whose payload executes with the privileges of the viewing admin against the WordPress database.
RemediationAI
No vendor-released patched version is identified in the available data - versions through 3.2.0 are affected and no fixed release is cited - so treat this as an unpatched issue and monitor the plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e35f18-7659-4b97-b99f-b57ac941cb22?source=cve) for a release above 3.2.0, applying it immediately once published. As compensating controls until a patch exists, disable open user self-registration (Settings > General > 'Anyone can register' unchecked) to remove the trivial path to a Subscriber account, which eliminates the primary attack surface with the trade-off of blocking legitimate new sign-ups; audit and remove untrusted low-privilege accounts; and if the reporting feature is not in active use, deactivate the WP Business Intelligence Lite plugin entirely, accepting loss of its dashboard reports. A Web Application Firewall rule (such as Wordfence) restricting the plugin's query-modification endpoint to administrator sessions can also blunt exploitation, at the cost of relying on request-pattern matching rather than a code-level fix.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today