What is the CVSS score of CVE-2026-3781?

CVE-2026-3781 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3781

EUVD-2026-20107 MEDIUM

SQL Injection (CWE-89)

2026-04-08 Wordfence

GHSA-6j4h-m95w-mr2q

WordPress SQLi

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20107

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 5.4

DescriptionCVE.org

The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Attendance Manager WordPress plugin (versions up to 0.6.2) allows authenticated attackers with Subscriber-level access to execute arbitrary SQL queries via the 'attmgr_off' parameter, enabling unauthorized extraction of sensitive database information. The vulnerability requires user authentication but can be exploited without further user interaction, with a CVSS score of 5.4 indicating moderate risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the Attendance Manager plugin for WordPress (CPE: cpe:2.3:a:tnomi:attendance_manager:*:*:*:*:*:*:*:*), affecting the plugin's form handling functionality. The root cause is classified under CWE-89 (SQL Injection) and stems from insufficient escaping and lack of parameterized query preparation in the SQL query construction process. Specifically, the 'attmgr_off' parameter is processed in the class-form.php file (lines 142 and 148 in the referenced code) without proper sanitization before being incorporated into SQL queries. This allows attackers to inject malicious SQL syntax that modifies the query logic, enabling data extraction attacks. WordPress plugins handle user input through various endpoints, and inadequate use of prepared statements with placeholders (such as wpdb->prepare()) represents a common vulnerability pattern in WordPress plugin development.

RemediationAI

Users of the Attendance Manager plugin should upgrade to a patched version beyond 0.6.2 as soon as a security release becomes available. Until a patch is released, site administrators should restrict Subscriber-level access by disabling open user registration and limiting plugin usage to trusted administrative accounts only. Additionally, implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'attmgr_off' parameter may provide temporary mitigation. Monitor the WordPress plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=cve) for patch availability announcements. Sites with sensitive customer or employee data should consider removing the plugin entirely until a security update is confirmed.