User Feedback CVE-2026-39475

Requires authenticated user access to WordPress with Syed Balkhi User Feedback plugin version <= 1.10.1 installed and activated. Attacker must be a logged-in user (subscriber or higher) to inject malicious SQL commands through plugin input fields.

The CVSS base score of 8.5 (High severity) reflects significant potential impact, driven primarily by the scope change modifier and high confidentiality breach capability. However, real-world risk is substantially moderated by multiple factors. The EPSS score of 0.02% (6th percentile) indicates extremely low probability of exploitation in the wild within 30 days, suggesting this vulnerability has not attracted widespread attacker attention. The authentication requirement (PR:L) creates a meaningful barrier, as attackers must first obtain valid WordPress credentials with at least subscriber-level access before exploiting the flaw. No confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis further reduce immediate risk. The blind nature of the SQL injection increases exploitation complexity compared to error-based variants, requiring attackers to use time-intensive boolean or time-based inference techniques. From an SSVC perspective: exploitation status is none, technical impact is partial (confidentiality breach with limited availability impact), and automatable exploitation is unlikely given authentication requirements. This results in a medium-priority remediation timeline for most organizations, elevated to high priority for sites with sensitive user data or where untrusted users have authenticated access. Organizations using defense-in-depth controls (Web Application Firewalls with SQLi signatures, database user privilege restrictions, input validation frameworks) have additional risk mitigation already in place.

An authenticated attacker with subscriber-level WordPress credentials submits a crafted HTTP request to a vulnerable User Feedback plugin endpoint, injecting malicious SQL syntax into a parameter processed without proper sanitization. Using blind SQL injection techniques such as boolean-based conditionals (e.g., AND 1=1 vs AND 1=2) or time-based delays (SLEEP functions), the attacker systematically extracts sensitive database contents including administrator credentials, user personal information, or proprietary business data character by character. The scope change property allows the attacker to potentially access database tables beyond the plugin's intended scope, compromising the entire WordPress installation's confidentiality.