EUVD-2026-55015Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Network-reachable unauthenticated SQLi with changed scope into shared WordPress DB; confidentiality only, no integrity or availability impact described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
AnalysisAI
SQL injection in the Term Pages WordPress plugin (versions before 2.0.0) allows unauthenticated remote attackers to execute arbitrary SQL queries against the WordPress database by submitting a crafted request containing a malicious parameter. The vulnerability stems from missing input sanitization and output escaping prior to SQL statement construction (CWE-89). A publicly available exploit exists per WPScan, though EPSS sits at just 0.18% (7th percentile), suggesting exploitation remains limited at this time despite accessible proof-of-concept code. No CISA KEV listing has been confirmed.
Technical ContextAI
Term Pages is a WordPress plugin (CPE: cpe:2.3:a:unknown:term_pages:*:*:*:*:*:*:*:*) that provides taxonomy-based page management functionality. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WordPress plugins that construct raw SQL queries - rather than using WordPress's $wpdb->prepare() method or parameterized queries - are susceptible to this class of flaw. In this case, a URL or form parameter is passed directly into a SQL statement without proper escaping or type casting, enabling an attacker to inject arbitrary SQL clauses. The CVSS Scope:Changed designation indicates the injected queries can affect data beyond the plugin's own database scope, potentially reaching other WordPress tables including wp_users, option tables, and data from other plugins sharing the same database.
RemediationAI
The primary remediation is to upgrade the Term Pages plugin to version 2.0.0 or later, which introduces proper sanitization and escaping of the affected parameter before SQL statement construction. The vendor-released patch is available through the WordPress plugin repository; site administrators should update immediately via the WordPress admin dashboard or WP-CLI (wp plugin update term-pages). The WPScan advisory at https://wpscan.com/vulnerability/3e07356a-5ac8-4d9f-bef2-65aaecbf1419/ provides additional detail. If immediate patching is not possible, a compensating control is to use a web application firewall (WAF) rule to block SQL injection patterns targeting the vulnerable parameter - note this is not a reliable long-term defense and may cause false positives. Alternatively, disabling the Term Pages plugin entirely until the patch can be applied eliminates the attack surface with the trade-off of losing plugin functionality.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today