What is the CVSS score of CVE-2026-32458?

CVE-2026-32458 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wolf are affected by CVE-2026-32458?

CVE-2026-32458 is a SQL injection vulnerability in the RealMag777 WOLF WordPress plugin that could allow compromised administrator accounts to access or manipulate database content.

How to fix or mitigate CVE-2026-32458?

Within 24 hours: Identify all WordPress instances running the RealMag777 WOLF plugin and document affected versions. Within 7 days: Audit administrator account access logs and restrict plugin use to essential administrators only; implement database query monitoring. Within 30 days: Evaluate alternative bulk-editor solutions and plan plugin replacement or deactivation; migrate away from the vulnerable plugin.

Wolf CVE-2026-32458

EUVD-2026-12015 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Wolf

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12015

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.

AnalysisAI

SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.

Technical ContextAI

The vulnerability affects the WOLF bulk-editor plugin (CPE: cpe:2.3:a:realmag777:wolf:*:*:*:*:*:*:*:*) for WordPress, specifically versions from inception through 1.0.8.7. As a CWE-89 vulnerability, it stems from improper neutralization of special SQL command elements, allowing attackers to inject malicious SQL queries. The plugin likely fails to properly sanitize user input before constructing database queries, a common issue in WordPress plugins that interact directly with the database.

RemediationAI

Update the WOLF bulk-editor plugin to a version newer than 1.0.8.7 if available. The Patchstack reference (https://patchstack.com/database/Wordpress/Plugin/bulk-editor/vulnerability/wordpress-wolf-plugin-1-0-8-7-sql-injection-vulnerability) likely contains patch information. As an immediate mitigation, restrict WordPress admin access to trusted users only and monitor database query logs for suspicious activity. Consider temporarily disabling the plugin if updates are not immediately available.