User Login History CVE-2026-2283

Two specific conditions must both be true for exploitation: (1) the WordPress installation must be operating in multisite mode (wp-config.php must define MULTISITE as true and the network must be configured - this is a non-default WordPress setup); and (2) the attacker must be authenticated with Administrator-level access or higher (CVSS PR:H), meaning they hold a valid admin session on the multisite network. Single-site WordPress installations are explicitly not affected regardless of credential level. What limits exploitation: the high privilege bar (PR:H) means a threat actor must have already compromised or legitimately hold admin credentials; the multisite constraint excludes the majority of WordPress deployments; and the impact is read-only (no integrity or availability loss per CVSS C:H/I:N/A:N).

The CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately captures the dominant risk limiter: PR:H requires Administrator-level authentication, meaning an attacker must already hold privileged access to the WordPress installation before the vulnerability is reachable. Combined with the multisite-only constraint - a non-default WordPress configuration - the realistic exposed population is substantially smaller than the full WordPress ecosystem. Confidentiality impact is rated High (C:H) because a successful injection can extract arbitrary database rows, potentially including credentials, user PII, and application secrets. Integrity and availability are unaffected per the CVSS vector, consistent with a read-only SQL injection path. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. The Wordfence report and plugin repository changeset 3484407 indicate a patch was committed, but no exact fixed version number is confirmed in the available data. Overall: low operational priority for single-site WordPress deployments; moderate priority for multisite installations where administrators are not fully trusted (e.g., large networks with delegated admin roles).

An attacker who already holds WordPress Administrator credentials on a multisite installation navigates to the Network Admin login history table and submits a crafted HTTP request with a malicious 'blog_id' value containing SQL metacharacters (e.g., a UNION SELECT clause). Because the parameter is interpolated without escaping or prepared statements at lines 70 and 116 of class-network-admin-login-list-table.php, the injected SQL executes against the WordPress database, returning sensitive data such as user password hashes or option table secrets in the response. No public exploit code has been identified, but the source-level references make the injection point trivially reproducible from the plugin repository browser.