Product Shortlist CVE-2026-16950

No authentication is required - the CVSS vector (PR:N) confirms exploitation by any unauthenticated remote attacker. The Product Shortlist plugin must be installed and activated on the target WordPress site running version 1.0.4 or earlier. No non-default plugin configuration is required. The specific vulnerable parameter and endpoint are not named in the available data, which slightly limits immediate automated exploitation but does not constitute a meaningful barrier. Exploitation is limited to sites where this specific plugin is active; sites that have deactivated or removed the plugin are not exposed.

The CVSS base score of 8.6 with a Scope:Changed, C:H, PR:N vector represents a genuine high-severity finding: unauthenticated network exploitation with cross-table database read access. The practical risk is bounded by install base - the EPSS score of 0.19% (9th percentile) is consistent with a low-prevalence plugin that has not yet attracted automated mass scanning. That said, even a mid-sized municipal IT team in legnica running this plugin on a public-facing WordPress site faces a realistic path to full credential disclosure with no barriers to exploitation. The absence of a KEV listing and the low EPSS together suggest opportunistic rather than targeted exploitation is not yet widespread, but the trivial attack complexity (AC:L, PR:N, UI:N) means this could be mass-exploited quickly once a scanner module exists. No conflicting signals exist between the CVSS vector and the vulnerability description - both confirm unauthenticated network access with high confidentiality impact.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site with the Product Shortlist plugin active, injecting a UNION-based or error-based SQL payload via the vulnerable parameter. The injected query reads from the wp_users table, extracting hashed passwords and email addresses for all registered users. No credentials or user interaction are required, making this trivially scriptable and suitable for automated mass scanning of WordPress installations.