What is the CVSS score of CVE-2026-24572?

CVE-2026-24572 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Nelio Software Nelio Content are affected by CVE-2026-24572?

A critical SQL injection vulnerability in Nelio Content plugin (versions ≤4.1.0) allows attackers to extract sensitive database information without authentication.

How to fix or mitigate CVE-2026-24572?

Within 24 hours: Identify all WordPress installations running Nelio Content and document version numbers; disable the plugin if not business-critical pending remediation. Within 7 days: Implement WAF rules blocking SQL injection patterns targeting the vulnerable plugin endpoints; review database access logs for exploitation attempts. Within 30 days: Either upgrade to patched version once available, migrate to alternative content management solutions, or maintain compensating controls with continuous monitoring.

Nelio Software Nelio Content CVE-2026-24572

HIGH

SQL Injection (CWE-89)

2026-01-23 audit@patchstack.com

SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 15:16 nvd

HIGH 8.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.1.0.

AnalysisAI

Nelio Content versions 4.1.0 and earlier contain a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary database queries over the network. This vulnerability requires valid user credentials but no user interaction, enabling attackers to read, modify, or delete sensitive database contents. No patch is currently available to address this high-severity flaw.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Nelio Software Nelio Content nelio-content. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.1.0.

Affected ProductsAI

Product: Nelio Software Nelio Content nelio-content.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.