What is the CVSS score of CVE-2026-31920?

CVE-2026-31920 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-31920?

CVE-2026-31920 presents critical security risk, a SQL injection vulnerability rated CVSS 9.3.

How to fix or mitigate CVE-2026-31920?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

WordPress CVE-2026-31920

EUVD-2026-15817 CRITICAL

SQL Injection (CWE-89)

2026-03-25 Patchstack

GHSA-pj5h-hpm3-5xqp

SQLi WordPress

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15817

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.

AnalysisAI

A blind SQL injection vulnerability exists in the Product Rearrange for WooCommerce plugin (versions up to 1.2.2) that allows attackers to execute arbitrary SQL commands against the WooCommerce database without direct output visibility. This affects WordPress installations using the Devteam HaywoodTech product-rearrange-woocommerce plugin, enabling attackers to extract sensitive data, modify database records, or potentially escalate privileges. While no CVSS score or EPSS data is currently published, the vulnerability's classification as blind SQL injection combined with its presence in a publicly available WordPress plugin suggests moderate to high real-world risk of exploitation.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL metacharacters in user-supplied input, classified under CWE-89 (SQL Injection). The affected product is the Product Rearrange for WooCommerce plugin (CPE: cpe:2.3:a:devteam_haywoodtech:product_rearrange_for_woocommerce:*:*:*:*:*:*:*:*), which extends WooCommerce functionality for WordPress. The blind SQL injection variant is particularly concerning because attackers can infer database structure and content through time-based or boolean-based techniques without receiving direct query results, making detection and remediation more complex than standard SQL injection. The vulnerability likely exists in input validation/sanitization layers where user-controlled parameters (such as product sorting, filtering, or rearrangement operations) are concatenated directly into SQL queries without parameterized statement protection.

RemediationAI

Immediately upgrade the Product Rearrange for WooCommerce plugin to a version newer than 1.2.2 (contact Devteam HaywoodTech or check the WordPress plugin repository for the latest patched release). If a patched version is not yet available, deactivate and remove the plugin until a fix is released, or implement database-level protections such as restricting the WooCommerce database user to minimal required privileges and implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns in plugin-related requests. Additionally, audit database access logs for signs of exploitation and consider enforcing database query logging at the MySQL/MariaDB level. Monitor the Patchstack vulnerability database and Devteam HaywoodTech official channels for official patch announcements.