Skip to main content

Library Management System CVE-2026-18666

| EUVDEUVD-2026-55029 MEDIUM
SQL Injection (CWE-89)
2026-08-10 WPScan GHSA-2c9h-p9wv-wmqh
SQLi WordPress Library Management System
4.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
7.1 HIGH

C:H assigned independently because extraction of arbitrary database data including all user password hashes is a high confidentiality impact; the official C:N appears to be a scoring error.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 23:49 vuln.today
CVSS changed
Aug 11, 2026 - 21:22 NVD
4.3 (MEDIUM)
Patch available
Aug 10, 2026 - 08:02 EUVD
CVE Published
Aug 10, 2026 - 06:00 cve.org
MEDIUM 4.3
CVE Published
Aug 10, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.

AnalysisAI

SQL injection in the Library Management System WordPress plugin (all versions before 3.6.7) allows any user holding a Subscriber role or higher to inject arbitrary SQL into the underlying WordPress database, extracting sensitive records including user password hashes. A publicly available proof-of-concept exploit is confirmed via WPScan. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Register Subscriber account or use existing credentials
Delivery
Identify vulnerable parameter in Library Management System plugin
Exploit
Craft SQL injection payload using public POC
Install
Submit malicious HTTP request to WordPress endpoint
C2
Extract wp_users table including password hashes
Execute
Crack hashes offline
Impact
Authenticate as administrator or reuse credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges - the lowest authenticated role in a default WordPress installation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3) contains a material scoring error: C:N (no confidentiality impact) is assigned despite the CVE description explicitly stating that attackers can extract 'arbitrary data from the database, including user password hashes' - a plainly high-confidentiality outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a free Subscriber account on a target WordPress site running Library Management System before 3.6.7, or uses an existing low-privilege account. Using the publicly available POC from WPScan, the attacker submits a crafted HTTP request with a SQL injection payload in the vulnerable plugin parameter. …
Remediation Update the Library Management System WordPress plugin to version 3.6.7 or later immediately; this is the vendor-released patch confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b273781f7b4/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Library Management System

View all
CVE-2023-7111 CRITICAL POC
9.8 Dec 26

A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Rated criti
CVE-2022-37794 CRITICAL POC
9.8 Sep 12

In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection. Rated crit
CVE-2022-36735 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admi
CVE-2022-36734 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admi
CVE-2022-36733 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/
CVE-2022-36732 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /libraria
CVE-2022-36731 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /libr
CVE-2022-36730 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /libr
CVE-2022-36714 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /sta
CVE-2022-36713 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /lib
CVE-2022-36712 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/st
CVE-2022-36711 CRITICAL POC
9.8 Aug 30

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bo

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-18666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy