What is the CVSS score of CVE-2026-24624?

CVE-2026-24624 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-24624?

A SQL injection vulnerability in Neoforum version 1.0 and earlier allows attackers to extract sensitive data through blind SQL injection attacks.

How to fix or mitigate CVE-2026-24624?

Within 24 hours: Identify all systems running Neoforum <= 1.0 and isolate them from production networks if possible; enable enhanced logging and monitoring for SQL error messages and unusual database queries. Within 7 days: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns; restrict database user privileges to minimum required permissions; consider disabling user-facing search or input features if feasible. Within 30 days: Upgrade to a patched version when available; conduct a forensic audit of database access logs; reset credentials for database service accounts and users who may have been compromised.

Wordpress Plugin CVE-2026-24624

HIGH

SQL Injection (CWE-89)

2026-01-23 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.2 (HIGH) 7.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 15:16 nvd

HIGH 7.2

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neoforum: from n/a through <= 1.0.

AnalysisAI

Blind SQL injection in Neoforum version 1.0 and earlier allows high-privileged attackers to execute arbitrary SQL commands over the network without user interaction, potentially compromising data confidentiality and integrity. The vulnerability stems from inadequate sanitization of user inputs in SQL queries, and no patch is currently available.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects saeros1984 Neoforum neoforum. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neoforum: from n/a through <= 1.0.

Affected ProductsAI

Product: saeros1984 Neoforum neoforum.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.