EUVD-2026-65162
GHSA-wh38-69hj-4c92
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated low-complexity network SQLi (AV:N/AC:L/PR:N/UI:N); high confidentiality from DB read, low integrity as injection may alter data, scope unchanged within the database backend.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
AnalysisAI
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets remote attackers inject arbitrary SQL through an unauthenticated request, exposing the WordPress database on any internet-facing site running the plugin. The CVSS 3.1 base score is 9.3 (critical) with a changed-scope, confidentiality-focused vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the PixelYourSite Boost plugin (version ≤2.0.4) is installed and activated on an internet-reachable WordPress site, with the vulnerable request-handling endpoint accessible - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, so no special configuration is described as necessary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version was identified at time of analysis (EUVD records the fix as "n/a" for versions ≤2.0.4), so an exact upgrade target cannot yet be cited - monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/boost/vulnerability/wordpress-boost-plugin-2-0-4-sql-injection-vulnerability) and the PixelYourSite changelog for a release above 2.0.4 and apply it immediately when available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances to identify sites running PixelYourSite Boost version 2.0.4 or earlier using automated WordPress security scanning tools, and flag those sites for immediate offline assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
PHP Object Injection in the Boost plugin for WordPress (versions up to and including 2.0.3) allows unauthenticated remot
Unauthenticated SQL injection in the PixelYourSite Boost plugin for WordPress (versions up to and including 2.0.3) allow
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated a
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain i
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today