EUVD-2026-68971
GHSA-9vm5-hh7p-3w4x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Cookie injection is network-accessible and low-complexity once conditions met; subscriber auth required (PR:L); impact is read-only exfiltration only (C:H, I:N, A:N); feature-gate dependency does not raise AC as it is a site configuration state, not an attacker-controlled variable.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.
AnalysisAI
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must hold simultaneously: the attacking user must possess a valid WordPress account at subscriber level or above (any registered role satisfies this - PR:L per CVSS vector), and the plugin's Login History feature must be explicitly enabled in the site configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score reflects a network-accessible attack requiring low-privilege authentication (PR:L) with no user interaction, yielding high confidentiality impact and zero integrity or availability impact - accurately characterizing a read-only SQL exfiltration primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A code changeset (revision 3648199) has been committed to the WordPress Plugin Trac repository, indicating an upstream fix exists; however, a specific patched release version number is not confirmed in the available intelligence and should be verified against the WordPress plugin repository before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Persistent Login
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today