Library Management System CVE-2026-18666

Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges - the lowest authenticated role in a default WordPress installation. No special plugin configuration, non-default settings, or elevated permissions beyond a basic registered account are required. On sites with open user self-registration enabled (a common configuration), this is functionally equivalent to unauthenticated exploitation since any visitor can create a Subscriber account. Limiting factors: the target site must have the vulnerable plugin installed and active; the attacker must possess at least one valid WordPress session on the target site; sites that disable self-registration and restrict account creation to administrators reduce the attacker pool to trusted users only. The CVSS vector confirms AV:N (network-reachable), AC:L (no special conditions or race conditions), PR:L (low-privilege authentication required), and UI:N (no victim interaction needed).

The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3) contains a material scoring error: C:N (no confidentiality impact) is assigned despite the CVE description explicitly stating that attackers can extract 'arbitrary data from the database, including user password hashes' - a plainly high-confidentiality outcome. This discrepancy is flagged; the official score significantly understates real risk and should not be used as a sole triage signal. EPSS at 0.17% (6th percentile) suggests limited current automated or mass exploitation activity, but a publicly available POC confirmed by WPScan lowers the technical barrier to manual exploitation to near-zero. No CISA KEV listing means large-scale active exploitation is not confirmed at time of analysis, though absence from KEV does not indicate safety. The PR:L requirement (Subscriber role) limits the attacker pool to registered users, but on WordPress sites with open self-registration this is effectively equivalent to unauthenticated access. Password hash extraction is a high-value objective enabling offline credential cracking and subsequent account takeover across the site and potentially reused credentials elsewhere.

An attacker registers a free Subscriber account on a target WordPress site running Library Management System before 3.6.7, or uses an existing low-privilege account. Using the publicly available POC from WPScan, the attacker submits a crafted HTTP request with a SQL injection payload in the vulnerable plugin parameter. The database returns the wp_users table contents, including hashed passwords for all WordPress users including administrators. The attacker then runs the hashes through an offline cracking tool to recover plaintext credentials.