EUVD-2026-14188
GHSA-vf2m-4v37-jw5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSet malicious qntn_wp_access cookie
-
ExploitPlugin executes unsanitized SQL query
-
ExecutionAttacker appends SQL commands
-
ImpactExtract sensitive database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Quentn WP plugin versions ≤1.2.12 installed on WordPress. Unauthenticated remote attacker can inject SQL via 'qntn_wp_access' cookie. No user interaction required. Default WordPress installations vulnerable. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates this is a network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction, making it highly accessible to attackers. The high confidentiality impact means attackers can extract sensitive data including user credentials, personal information, and database contents. However, the lack of integrity or availability impact limits the scope to data exfiltration rather than system compromise. While no EPSS score, KEV listing, or public proof-of-concept is mentioned, the straightforward nature of SQL injection exploitation and the unauthenticated attack vector make this vulnerability automatable and likely to be exploited once details become widely known. The presence of detailed source code references in the WordPress plugin repository makes it easy for attackers to analyze and develop exploits. This should be prioritized for patching on any WordPress installation using the Quentn WP plugin. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious HTTP request to a WordPress site running the vulnerable Quentn WP plugin, including a specially crafted 'qntn_wp_access' cookie containing SQL injection payloads such as UNION SELECT statements. When the plugin's get_user_access() method processes this cookie value without proper sanitization, the injected SQL executes against the WordPress database, allowing the attacker to enumerate database tables, extract user credentials including administrator password hashes, retrieve customer data, API keys, or other sensitive information stored in the database. Since the vulnerability requires no authentication and has low attack complexity, automated scanners and botnet operators can easily mass-exploit vulnerable WordPress installations once exploit code becomes publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 21, 2026
The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extract sensitive database information through a malicious 'qntn_wp_access' cookie value. All versions up to and including 1.2.12 are affected. With a CVSS score of 7.5 and requiring no authentication or user interaction, this represents a significant risk for WordPress sites using this plugin, though no active exploitation (KEV) or public proof-of-concept has been documented at this time.
RemediationAI
WordPress administrators should immediately update the Quentn WP plugin to a version newer than 1.2.12 once a patched version becomes available from the vendor. Monitor the official WordPress plugin repository and Quentn's vendor communications for security updates. Until a patch is deployed, consider temporarily disabling the Quentn WP plugin if it is not critical to operations. Implement Web Application Firewall (WAF) rules to filter malicious cookie values targeting the 'qntn_wp_access' parameter, specifically blocking patterns consistent with SQL injection payloads such as UNION statements, comment sequences, and SQL metacharacters. Review database access logs for suspicious queries and consider restricting database user permissions to limit the impact of potential SQL injection attacks. Consult Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/653e20ae-f018-41b5-a973-f73fddae70e5?source=cve for additional mitigation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Quentn WP WordPress plugin (CPE: cpe:2.3:a:quentn:quentn_wp:*:*:*:*:*:*:*:*), specifically in the get_user_access() method within the class-quentn-wp-restrict-access.php file. The root cause is classified as CWE-89 (SQL Injection), resulting from insufficient escaping of user-supplied input from the 'qntn_wp_access' cookie parameter and inadequate parameterization of SQL queries. WordPress plugins often handle cookies for authentication and access control, and when these cookie values are directly concatenated into SQL queries without proper sanitization or use of prepared statements, attackers can inject arbitrary SQL commands. The vulnerability exists at line 483 of the affected file, where the cookie value is processed without adequate input validation or query parameterization.
Know when Quentn Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the get_user_access() method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
A high-severity SQL injection vulnerability in the Quentn WP WordPress plugin (versions ≤1.2.12) allows attackers to extract sensitive database information without authentication. Any organization running this plugin faces immediate risk of data breach, credential compromise, and potential regulatory violations, particularly if customer or payment data is exposed.
Implement Web Application Firewall (WAF) rules to block malicious 'qntn_wp_access' cookie patterns and SQL injection payloads; restrict plugin access via network segmentation or IP allowlisting if possible; monitor database access logs for suspicious queries; disable the plugin entirely if not essential to business operations; consider rotating database credentials and reviewing access logs for evidence of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract
Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators)
Exploit-DB