EUVD-2026-20107
GHSA-6j4h-m95w-mr2q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Attendance Manager WordPress plugin (versions up to 0.6.2) allows authenticated attackers with Subscriber-level access to execute arbitrary SQL queries via the 'attmgr_off' parameter, enabling unauthorized extraction of sensitive database information. The vulnerability requires user authentication but can be exploited without further user interaction, with a CVSS score of 5.4 indicating moderate risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability exists in the Attendance Manager plugin for WordPress (CPE: cpe:2.3:a:tnomi:attendance_manager:*:*:*:*:*:*:*:*), affecting the plugin's form handling functionality. The root cause is classified under CWE-89 (SQL Injection) and stems from insufficient escaping and lack of parameterized query preparation in the SQL query construction process. Specifically, the 'attmgr_off' parameter is processed in the class-form.php file (lines 142 and 148 in the referenced code) without proper sanitization before being incorporated into SQL queries. This allows attackers to inject malicious SQL syntax that modifies the query logic, enabling data extraction attacks. WordPress plugins handle user input through various endpoints, and inadequate use of prepared statements with placeholders (such as wpdb->prepare()) represents a common vulnerability pattern in WordPress plugin development.
RemediationAI
Users of the Attendance Manager plugin should upgrade to a patched version beyond 0.6.2 as soon as a security release becomes available. Until a patch is released, site administrators should restrict Subscriber-level access by disabling open user registration and limiting plugin usage to trusted administrative accounts only. Additionally, implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'attmgr_off' parameter may provide temporary mitigation. Monitor the WordPress plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve) for patch availability announcements. Sites with sensitive customer or employee data should consider removing the plugin entirely until a security update is confirmed.
More in Attendance Manager
View allCross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijac
SQL injection in the Attendance Manager WordPress plugin version 0.6.2 and earlier allows authenticated users with subsc
Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary w
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today