EUVD-2026-54884
GHSA-6hh8-5xhj-2p65
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AJAX endpoint is network-reachable requiring only a Subscriber session (PR:L); SQL injection yields full DB read/write (C:H/I:H) with no availability impact confirmed.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
AnalysisAI
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
Technical ContextAI
CubeWP Framework is a WordPress plugin providing page-builder and custom post type framework functionality. The vulnerability exists in a WordPress AJAX action handler (routed through admin-ajax.php) that processes a user-controlled parameter by concatenating it directly into a SQL query without sanitization or escaping - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. A critical compounding weakness is the complete absence of a WordPress capability check on the AJAX hook, which means any authenticated session - including the default Subscriber role, the lowest privilege level in WordPress - can invoke the vulnerable action. This eliminates the access-control safety net that would otherwise restrict sensitive AJAX operations to administrators or editors. Affected versions span the entire release history of the plugin up to but not including 1.1.31, per EUVD-2026-54884 data.
RemediationAI
Update the CubeWP Framework WordPress plugin to version 1.1.31 or later immediately; this is the vendor-released patch confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/50d95281-7b3f-4d5a-bf04-8e7bd88f4b55/. WordPress site owners can apply this through the standard Plugins update interface or via WP-CLI. If updating is temporarily blocked, disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted external parties from obtaining the Subscriber accounts required for exploitation - note this does not protect against existing low-privilege internal users. As an additional compensating control, a Web Application Firewall rule blocking SQL metacharacter patterns (single quotes, UNION, SELECT) in AJAX POST bodies targeting the specific vulnerable parameter can reduce exploitation risk, though the parameter name is not publicly disclosed in current advisories. There is no indication of a known workaround that eliminates the vulnerability without patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today