What is the CVSS score of CVE-2026-3334?

CVE-2026-3334 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3334?

WordPress sites using the CMS Commander plugin are vulnerable to SQL injection attacks by authenticated users with API key access, potentially exposing sensitive database information including…. A patch is available.

How to fix or mitigate CVE-2026-3334?

Within 24 hours: Audit all users with API key access and document current CMS Commander plugin versions in use. Within 7 days: Implement network segmentation to restrict API access, deploy WAF rules to filter malicious SQL patterns in the affected parameters, and disable the restore workflow feature if operationally feasible. Within 30 days: Establish vendor communication to obtain patching timeline, evaluate alternative plugins, or plan migration strategy; conduct database access review and implement principle of least privilege for API credentials.

WordPress CVE-2026-3334

EUVD-2026-14016 HIGH

SQL Injection (CWE-89)

2026-03-21 Wordfence

GHSA-ghq8-9c7r-622r

GHSA-hh8v-hgvp-g3f5

GHSA-jp2q-39xq-3w4g

GHSA-ph8x-4jfv-v9v8

GHSA-rfx7-8w68-q57q

WordPress SQLi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14016

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 8.8

DescriptionCVE.org

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers, with CMS Commander API key access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The CMS Commander plugin for WordPress contains an SQL Injection vulnerability in all versions up to and including 2.288. Authenticated attackers with API key access can exploit the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in the restore workflow to append malicious SQL queries and extract sensitive database information. With a CVSS score of 8.8, this represents a high-severity vulnerability requiring low attack complexity and low privileges, though no active exploitation (KEV) or public POC has been reported at this time.

Technical ContextAI

This vulnerability affects the CMS Commander WordPress plugin (cpe:2.3:a:thoefter:cms_commander_–_manage_multiple_sites), specifically within the backup and restore functionality implemented in CMSC/Backup.php. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied parameters 'or_blogname', 'or_blogdescription', and 'or_admin_email' in the restore workflow are not properly escaped or sanitized before being incorporated into SQL queries. The vulnerability exists in code paths at lines 1639 and 1366 of the Backup.php file, where direct concatenation or insufficient parameterization allows SQL query manipulation. CMS Commander is a centralized management tool for administering multiple WordPress installations, making this vulnerability particularly concerning as it could expose data across managed sites.

RemediationAI

Users should immediately upgrade the CMS Commander plugin to a version later than 2.288 that addresses this SQL injection vulnerability, consulting the plugin's official WordPress repository or the developer's website for the patched release. Until patching is completed, organizations should implement compensating controls including restricting API key distribution to only essential administrators, rotating existing API keys to ensure no unauthorized access, implementing network-level restrictions to limit API endpoint access to trusted IP ranges, and enabling comprehensive database query logging to detect potential exploitation attempts. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0311b546-01a4-4be8-97f3-6df6cd79c3fe?source=cve for updated remediation guidance and consider temporarily disabling the plugin if it is not critical to operations and no patch is yet available.