EUVD-2026-12015Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
ExploitSubmit crafted SQL payload in bulk-editor input
-
ExecutionExecute blind SQL injection queries
-
ImpactExtract sensitive database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | High-privilege user account required for WOLF bulk-editor version <= 1.0.8.7. Attacker must have authenticated administrative or editor-level access to the application. |
| Impact | Despite the high CVSS score of 7.6, the real-world risk is moderate. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) indicates network-accessible attack requiring high privileges (likely WordPress admin access). The extremely low EPSS score (0.02%, 5th percentile) suggests minimal exploitation activity. No KEV listing confirms it's not actively exploited. The high privilege requirement significantly reduces the attack surface - if an attacker already has admin access, they likely have other attack vectors available. This is a lower priority than the CVSS score suggests. |
| Exploit ScenarioDerived | An attacker with WordPress administrator credentials could exploit this blind SQL injection vulnerability by manipulating input fields in the WOLF bulk-editor interface. Since it's a blind SQL injection, the attacker would need to use time-based or boolean-based techniques to extract database information character by character. Given the high privilege requirement and network accessibility, this would most likely be exploited by malicious insiders or through compromised admin accounts rather than external attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.
RemediationAI
Update the WOLF bulk-editor plugin to a version newer than 1.0.8.7 if available. The Patchstack reference (https://patchstack.com/database/Wordpress/Plugin/bulk-editor/vulnerability/wordpress-wolf-plugin-1-0-8-7-sql-injection-vulnerability) likely contains patch information. As an immediate mitigation, restrict WordPress admin access to trusted users only and monitor database query logs for suspicious activity. Consider temporarily disabling the plugin if updates are not immediately available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the WOLF bulk-editor plugin (CPE: cpe:2.3:a:realmag777:wolf:*:*:*:*:*:*:*:*) for WordPress, specifically versions from inception through 1.0.8.7. As a CWE-89 vulnerability, it stems from improper neutralization of special SQL command elements, allowing attackers to inject malicious SQL queries. The plugin likely fails to properly sanitize user input before constructing database queries, a common issue in WordPress plugins that interact directly with the database.
Know when Wolf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.
Executive ViewAI
CVE-2026-32458 is a SQL injection vulnerability in the RealMag777 WOLF WordPress plugin that could allow compromised administrator accounts to access or manipulate database content. While the vulnerability requires administrator-level access and is not currently being exploited, organizations using this plugin should take immediate action to reduce insider risk and prevent potential data breaches.
Deactivate and remove the RealMag777 WOLF plugin immediately if not actively required. If continued use is necessary: restrict administrator role to essential personnel only, implement Web Application Firewall (WAF) rules to block SQL injection patterns in WordPress requests, enable database activity monitoring and alerting, enforce principle of least privilege on database accounts, and conduct quarterly access reviews of administrator accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows
GitHub PoC
Exploit-DB