Skip to main content

Organici Library CVE-2026-24977

| EUVD-2026-15594 HIGH
SQL Injection (CWE-89)
2026-03-25 Patchstack GHSA-h32g-9c53-mwvr
SQLi Organici Library
8.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

4
Re-analysis Queued
Apr 24, 2026 - 16:37 vuln.today
cvss_changed
EUVD ID Assigned
Mar 25, 2026 - 16:47 euvd
EUVD-2026-15594
Analysis Generated
Mar 25, 2026 - 16:47 vuln.today
CVE Published
Mar 25, 2026 - 16:14 nvd
HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

AnalysisAI

A blind SQL injection vulnerability exists in NooTheme's Organici Library WordPress plugin through version 2.1.2, allowing unauthenticated attackers to extract sensitive data from the underlying database without direct error feedback. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Commands) and has been documented by Patchstack as a critical WordPress plugin security issue. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privilege user
Delivery
Craft malicious SQL in plugin parameter
Exploit
Send blind SQL injection payload
Execution
Extract database information via timing/error responses
Impact
Compromise confidentiality of sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Authenticated user with any login access to WordPress site running NooTheme Organici Library version ≤2.1.2. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The risk assessment is complicated by missing CVSS vector and EPSS score data; however, several factors indicate moderate-to-high real-world severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scans the web for WordPress sites running the Organici Library plugin and crafts time-based blind SQL injection payloads targeting a vulnerable parameter in the plugin's query handler (e.g., a REST endpoint or form submission). By observing response delays introduced via database sleep functions, the attacker systematically extracts database table names, column names, and user credential hashes from the WordPress wp_users table. …
Remediation The primary remediation is to upgrade NooTheme Organici Library to a version newer than 2.1.2 as soon as a patched release is available; administrators should check the vendor's official repository or Patchstack for the patched version number and upgrade timeline. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 7 days: Identify all affected systems and apply vendor patches promptly. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-24977 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy