What is the CVSS score of CVE-2026-28136?

CVE-2026-28136 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-28136?

A SQL injection vulnerability in the WP SMS plugin (versions through 6.9.12) poses a direct threat to WordPress environments using this plugin, potentially allowing attackers to access, modify, or…

How to fix or mitigate CVE-2026-28136?

Within 24 hours: Audit all WordPress instances for WP SMS plugin installation and version; disable the plugin if not actively required or isolate affected systems from public internet access. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the WP SMS plugin parameters; document all affected systems and notify stakeholders of the risk. Within 30 days: Monitor vendor communications for patch availability and establish a deployment plan; evaluate alternative SMS plugins or custom solutions if VeronaLabs does not release a timely patch.

WordPress CVE-2026-28136

HIGH

SQL Injection (CWE-89)

2026-02-26 audit@patchstack.com

WordPress SQLi

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 26, 2026 - 09:16 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through <= 6.9.12.

AnalysisAI

The WP SMS plugin for WordPress through version 6.9.12 contains an SQL injection vulnerability that allows high-privileged authenticated users to manipulate database queries and extract sensitive information. An attacker with administrative credentials could exploit this to read arbitrary data from the WordPress database, potentially compromising user information and site configuration. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects VeronaLabs WP SMS wp-sms. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through <= 6.9.12.

Affected ProductsAI

Product: VeronaLabs WP SMS wp-sms.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.