What is the CVSS score of CVE-2026-28156?

CVE-2026-28156 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Do Lasso are affected by CVE-2026-28156?

The Do Lasso WordPress plugin (versions 358 and earlier) exposes a SQL injection flaw that allows any registered subscriber account to extract the complete WordPress database, including…

How to fix or mitigate CVE-2026-28156?

Within 24 hours: Identify all WordPress installations running Do Lasso plugin version 358 or earlier; audit active subscriber accounts for anomalous database queries; disable the plugin if subscriber registration is not critical to operations. Within 7 days: Contact Do Lasso vendor for patch timeline and evaluate functionally equivalent replacement plugins; if the plugin cannot be removed, deploy Web Application Firewall rules to block SQL injection patterns. Within 30 days: either apply vendor-released patch once available and validate the fix, or complete migration to a replacement plugin and uninstall Do Lasso from all affected WordPress instances.

Do Lasso CVE-2026-28156

EUVD-2026-57949 HIGH

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-87hp-hrvg-crh2

WordPress SQLi Wordpress Plugin Do Lasso Lasso Analytics Inc

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

PR:L confirmed by subscriber-level access requirement; S:C reflects cross-table database exposure in shared WordPress MySQL instance; I:N consistent with read-only SELECT injection; A:L for minor incidental availability side-effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:57 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in Do Lasso <= 358 versions.

AnalysisAI

SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.

Technical ContextAI

Do Lasso, developed by Lasso Analytics, Inc. (CPE: cpe:2.3:a:lasso_analytics,_inc.:do_lasso:*:*:*:*:*:*:*:*), is a WordPress affiliate link management plugin. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that subscriber-supplied input is concatenated directly into a SQL query without proper sanitization or use of parameterized queries - the canonical pattern in WordPress plugins that bypass $wpdb->prepare(). The CVSS scope-changed indicator (S:C) and high confidentiality impact (C:H) together suggest the injection reaches shared database tables beyond the plugin's own namespace, consistent with WordPress's single-instance MySQL architecture where all plugins share one database. The absence of integrity impact (I:N) in the CVSS vector implies a read-only exploitation path, most likely a UNION- or boolean-based SELECT injection rather than INSERT/UPDATE/DELETE.

RemediationAI

Update the Do Lasso plugin to a version beyond 358 via the WordPress plugin dashboard or repository. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/lasso/vulnerability/wordpress-do-lasso-plugin-358-sql-injection-vulnerability?_s_id=cve) for the confirmed fixed version number, as the exact patched release was not independently specified in the available intelligence. As an immediate compensating control, administrators can disable open subscriber registration under Settings → General → uncheck 'Anyone can register', which eliminates the low-privilege attack path at the cost of preventing self-service account creation. Web application firewall rules targeting SQL metacharacters in plugin-related HTTP parameters provide additional detection layering. If the plugin cannot be updated or deactivated promptly, restricting access to the WordPress installation via IP allowlisting for non-administrative users significantly reduces the exposure surface.