What is the CVSS score of CVE-2026-2503?

CVE-2026-2503 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2503?

Organizations using all should be aware of notable risk from CVE-2026-2503, a SQL injection vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input.

How to fix or mitigate CVE-2026-2503?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

WordPress CVE-2026-2503

EUVD-2026-14163 MEDIUM

SQL Injection (CWE-89)

2026-03-21 Wordfence

GHSA-95c6-28c3-2pjc

GHSA-r7mg-x5pg-j8pc

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14163

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc_sql(), but since the payload operates as an operator (not inside quotes), esc_sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The ElementCamp plugin for WordPress contains a time-based SQL injection vulnerability in the 'tcg_select2_search_post' AJAX action through improper validation of the 'meta_query[compare]' parameter. Authenticated attackers with Author-level privileges or higher can inject arbitrary SQL operators to extract sensitive database information, as the vulnerable code places user-supplied comparison operators directly into SQL queries without allowlist validation, rendering esc_sql() ineffective for operator-level payloads. The CVSS score of 6.5 reflects moderate severity with high confidentiality impact but no integrity or availability impact, limited to authenticated users with elevated privileges.

Technical ContextAI

The vulnerability exists in the ElementCamp plugin (CPE: cpe:2.3:a:wpdive:elementcamp:*:*:*:*:*:*:*:*) specifically within the tcg-select2.php file's AJAX handler for the 'tcg_select2_search_post' action. The root cause is classified as CWE-89 (SQL Injection) and stems from unsafe handling of SQL comparison operators in meta_query parameters. The vulnerable code accepts user-supplied compare values that are passed through esc_sql(), which only escapes string literals and quote characters; since SQL operators exist outside of quoted contexts, the function provides no protection against operator-level injection. The WordPress meta_query API is intended to accept only predefined comparison operators (=, !=, <, >, etc.), but this implementation fails to enforce such a whitelist, allowing attackers to append additional SQL conditions or subqueries that execute within the database context of the WordPress installation.

RemediationAI

Immediately upgrade the ElementCamp plugin to a version newer than 2.3.6 where the compare parameter validation has been corrected to use an allowlist of permitted SQL operators. Visit the WordPress plugin repository or WPDive's official channels to obtain the patched version and apply it through the WordPress admin dashboard. Until patching is possible, restrict Author-level and above WordPress user accounts to trusted administrators only, and disable the 'tcg_select2_search_post' AJAX action if it is not actively used by disabling the plugin if possible. Additionally, implement WordPress security hardening practices such as enforcing strong password policies, enabling two-factor authentication, and monitoring database query logs for anomalous time-based injection patterns. For defense-in-depth, consider using a Web Application Firewall (WAF) rule to detect and block requests containing SQL injection patterns in the 'meta_query[compare]' parameter. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b for detailed patch availability and release information.