What is the CVSS score of CVE-2026-2468?

CVE-2026-2468 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2468?

A high-severity SQL injection vulnerability in the Quentn WP WordPress plugin (versions ≤1.2.12) allows attackers to extract sensitive database information without authentication.

How to fix or mitigate CVE-2026-2468?

Within 24 hours: Identify all WordPress instances using Quentn WP plugin and document affected systems. Within 7 days: Disable or deactivate the Quentn WP plugin across all environments as a temporary measure; contact vendor for patch timeline and alternative solutions. Within 30 days: Either apply vendor patch upon availability, migrate to an alternative plugin, or implement compensating WAF controls if the plugin remains business-critical.

WordPress CVE-2026-2468

EUVD-2026-14188 HIGH

SQL Injection (CWE-89)

2026-03-21 Wordfence

GHSA-vf2m-4v37-jw5p

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14188

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 7.5

DescriptionCVE.org

The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the get_user_access() method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The Quentn WP plugin for WordPress contains an SQL Injection vulnerability that allows unauthenticated attackers to extract sensitive database information through a malicious 'qntn_wp_access' cookie value. All versions up to and including 1.2.12 are affected. With a CVSS score of 7.5 and requiring no authentication or user interaction, this represents a significant risk for WordPress sites using this plugin, though no active exploitation (KEV) or public proof-of-concept has been documented at this time.

Technical ContextAI

This vulnerability affects the Quentn WP WordPress plugin (CPE: cpe:2.3:a:quentn:quentn_wp:*:*:*:*:*:*:*:*), specifically in the get_user_access() method within the class-quentn-wp-restrict-access.php file. The root cause is classified as CWE-89 (SQL Injection), resulting from insufficient escaping of user-supplied input from the 'qntn_wp_access' cookie parameter and inadequate parameterization of SQL queries. WordPress plugins often handle cookies for authentication and access control, and when these cookie values are directly concatenated into SQL queries without proper sanitization or use of prepared statements, attackers can inject arbitrary SQL commands. The vulnerability exists at line 483 of the affected file, where the cookie value is processed without adequate input validation or query parameterization.

RemediationAI

WordPress administrators should immediately update the Quentn WP plugin to a version newer than 1.2.12 once a patched version becomes available from the vendor. Monitor the official WordPress plugin repository and Quentn's vendor communications for security updates. Until a patch is deployed, consider temporarily disabling the Quentn WP plugin if it is not critical to operations. Implement Web Application Firewall (WAF) rules to filter malicious cookie values targeting the 'qntn_wp_access' parameter, specifically blocking patterns consistent with SQL injection payloads such as UNION statements, comment sequences, and SQL metacharacters. Review database access logs for suspicious queries and consider restricting database user permissions to limit the impact of potential SQL injection attacks. Consult Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/653e20ae-f018-41b5-a973-f73fddae70e5?source=cve for additional mitigation guidance.